This is a security hardening measure; don't trust the URL extension or any `Content-Type`/`Content-Disposition` header on its own, always look at the file content using Go's `http.DetectContentType`.
This commit also adds ttf and otf media type definitions to Hugo.
Fixes#9302Fixes#9301
This allows for constructs ala:
```
{{ $overlay := $img.Filter (images.Overlay $logo 50 50 )}}
```
Or:
```
{{ $logoFilter := (images.Overlay $logo 50 50 ) }}
{{ $overlay := $img | images.Filter $logoFilter }}
```
Which will overlay the logo in the top left corner (x=50, y=50) of `$img`.
Fixes#8057Fixes#4595
Updates #6731