Upgrade to Paperclip 4.

This adds some nice security features, including content-type
validations and spoof checking. We also get an IO adapter for
StringIOs, so we can drop a core_ext.