Upload filenames are already processed via htmlspecialchars in the
type_cast_helper of the new request class. There is no need to run it through
htmlspecialchars() again in the filespec class.
PHPBB3-12211
fileupload::image_types() and filespec::get_extension() are called
statically while submitting the form for the remote avatar. Make them
static as described in the ticket in order to prevent a PHP notice.
Also change the tests to use the static functions.
PHPBB3-10763
