Harden low file upload handling

[r1kka6]

Summary

• validate low-level uploads as server-decoded JPEG or PNG images instead of trusting the supplied filename and MIME type
• re-encode accepted images through GD and store them under random filenames with trusted extensions
• reject malformed, empty, oversized, and non-image uploads before anything reaches the public upload directory

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/upload/source/low.php
• vulnerable baseline stores dvwa-upload-shell.php and executing /hackable/uploads/dvwa-upload-shell.php returns PWNED
• patched runtime rejects the same PHP payload, accepts a legitimate JPEG as a random .jpg, and leaves the original shell path at 404