Reject bulk zips with non-whitelisted files

We considered re-using the AttachmentUploader's whitelist examiner,
but it was too coupled to AttachmentUploader's specifics. We're still
reaching in to AttachmentUploader to get the list of whitelist
extensions, which feels mucky, but the pressure is on to get this
work finished. Have made a note to address some of this at a later
stage