block_file_extensions.sh can be circumvented with fork + PR

The `block_file_extensions.sh` pre-receive-hook can be circumvented by:

1. Fork the repository
2. Add a file with the blocked exension
3. Submit a pull request
4. Merge pull request

We've done a little research and suspect that this is due to the:
```
excludeExisting="--not --all"
```

I guess we could mitigate, e.g. by adding `block_self_merge_prs.sh`, but this could still be circumvented if 2 users with write privileges colluded.

Any thoughts?

Start by reviewing block_file_extensions.sh, especially the excludeExisting="--not --all" behavior, and trace how forked pull requests are evaluated. The issue does not name a test or a concrete fix; done would require an agreed mitigation that prevents the reported bypass while addressing the stated collusion concern.

由索引模型根据 Issue 内容生成。