Always use content to resolve content type in resources.GetRemote

This is a security hardening measure; don't trust the URL extension or any `Content-Type`/`Content-Disposition` header on its own, always look at the file content using Go's `http.DetectContentType`.

This commit also adds ttf and otf media type definitions to Hugo.

Fixes #9302
Fixes #9301

tpl/transform/unmarshal.go

@@ -95,6 +95,10 @@ func (ns *Namespace) Unmarshal(args ...interface{}) (interface{}, error) {
 		return nil, errors.Errorf("type %T not supported", data)
 	}
 
+	if dataStr == "" {
+		return nil, errors.New("no data to transform")
+	}
+
 	key := helpers.MD5String(dataStr)
 
 	return ns.cache.GetOrCreate(key, func() (interface{}, error) {