XWiki-9366 : XSS via FileUpload. Make it configurable