Users can upload any file as PWA Firebase JSON config

[SKevo18]

For context, I have just had an user upload a PNG image as the Firebase config, which prevented the Flarum JSON payload from rendering altogether, making the admin panel load infinitely even after all extensions have been disabled. Manually clearing the file from the settings in the DB fixes the issue.

I am not sure how is the file parsed exactly, but I feel like there should be some handler for edge cases like this (perhaps by checking mimetypes, etc.?)