Message attachments honoured the sender's inline disposition for any type, and
the Drive and preview checks compared raw Content-Type strings, so
image/svg+xml;charset=utf-8 or image/png, text/html passed. The per-route CSP
sandbox was the only guard, and on the Node runtime Next.js drops it in favour of
the global CSP from next.config, which allows inline script.
Parse the MIME essence, allowlist inline types, and send back only the parsed
type.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
