Allow user to override allowed filename extensions

The code and the comments here were wrong. It claimed to still look at the (5.6) UPLOAD_FILE_EXTENSIONS_ALLOWED constant, but it only looked at the 'concrete.upload.extensions' configuration. This basically means that you can't override it without editing the core.

I adjusted the code to first check if the user has provided an alternative list of allowed upload extensions, and to fall back to the default list if he/she hasn't. I also adjusted the documentation to match this behavior.