Add 'phtm' to the displayed list of extensions for the security checks.

The security checker for file attachment extensions was checking .phtm files,
but they weren't listed in the text.

Trivial fix.

Fixes part of bug 3368.
Merge branch 'release-2.0.x'