Support wildcard types e.g. `image/*`

It would be very useful to be able to say "any kind of image is fine" with e.g. `image/*` as an allowed type, rather than having to list out every specific image format you want to expect.

For responsibility it should be documented as to be considered carefully, as e.g. `image/*` feels harmless as it's just image formats, but that includes `image/svg+xml` which can carry risks via XML external entity attacks, CSS exfiltration using fonts, scripts etc - so not just "an image"!)

To go along with it, it would probably also be useful to be able to negate MIME types, so you could say "all images, except..." e.g. `image/* !image/svg+xml` or similar so that it's possible to skip particular ones you're worried about without having to go back to listing out every other acceptable type.

No file or test is named in the issue. Start by locating the plugin's existing allowed-MIME-type validation and its tests; done means wildcard and negated MIME types behave as agreed, with security documentation covering SVG and related risks.

Written by the indexing model from the issue text.