feat: allow skipping magic numbers validation for image uploads in company info controller

[Artuomka]

No description provided.

[Copilot]

Pull request overview

This PR adjusts file upload validation in the company info controller to allow bypassing “magic numbers” (file signature) checks when validating uploaded image types, likely to accommodate image formats that fail signature detection.

Changes:

• Set skipMagicNumbersValidation: true on the file type validator for company logo uploads.
• Set skipMagicNumbersValidation: true on the file type validator for company favicon uploads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Setting skipMagicNumbersValidation: true on the image upload FileTypeValidator weakens server-side file validation and makes the check rely primarily on the client-provided mimetype (which can be spoofed). Since the upload use case persists file.buffer as-is and later returns it to clients alongside mimeType, this can allow non-image payloads to be stored and served as image/*. Consider keeping magic-number validation enabled for binary image types (png/jpeg) and handling problematic types (e.g. svg) with a dedicated validator/sanitization step instead of disabling signature validation globally.

Suggested change

	.addFileTypeValidator({ fileType: /image\/(png|jpeg|jpg|svg\+xml)/, skipMagicNumbersValidation: true })
	.addFileTypeValidator({ fileType: /image\/(png|jpeg|jpg|svg\+xml)/ })

[Copilot]

Same concern here: disabling magic-number/signature validation for favicon uploads makes it possible to upload arbitrary bytes while claiming an image/* mimetype. If this was added to work around SVG/favicon detection issues, it would be safer to keep signature validation for png/jpeg and apply a separate allowlist + sanitization/validation path for formats that can’t be reliably magic-checked.