only allow certain file types to be written to Level 4

As a minimum: txt csv tsv log json svg png jpeg ipynb md html pdf.

My main thinking for this is that R objects often contain the the arguments that were passed to them, such as data frames (and sometimes entire environments). This is Bad because a user might be tempted to release that object out of L4 for local processing, without realising the security implications. For example a ggplot object contains the data used to plot the object, even if the plot is for lower dimension derivations of the data like a density plot or a chart showing pairwise correlations. There are lots of other examples.

Github's 100mb file limit won't catch everything, especially with compression. Asumming a whitelist is probably safer than a blacklist.

Arguably html md and pdf could contain disclosive info that isn't visible when rendered but i think that's a separate issue.

May need a system request additional file types.

The issue names no files, tests, or entry points. Start by locating the Level 4 write path; done would require an agreed file-type whitelist and a defined way to request additional types.