API Remove html,htm,xhtml,xml as default allowed uploadable file types

Related to a relevant CWP security ticket.

Since html files no longer validate, but are necessary for the system (such as the creation of error-404.html), these files are now hidden from the AssetAdmin by default and do not get picked up by file synchronisation.

cc @hafriedlander