Always rename dot files regardless of the configured file extensions creating defense in depth

Problem/Motivation

https://www.drupal.org/sa-core-2022-014 improved handling of dot files in the case that htaccess is in the list of allowed extensions. However Drupal 7 will always rename dot files. I think Drupal 9 and 10 should have the same behaviour - for example uploading a .htpasswd file could have interesting consequences.

The problem is that

    // Dot files are renamed regardless of security settings.
    $filename = trim($filename, '.');

is not actually true because further down the method we do an early exit if we think file_validate_extensions() is going to reject it. But unfortunately the logic in file_validate_extensions() and this method are not 100% the same. At some point we should add a static method that file_validate_extensions() calls so we can be sure that the logic is 100% the same.

However in this case the fix is simpler we should do

    if ($filename !== $event->getFilename()) {
      $event->setFilename($filename)->setSecurityRename();
    }

immediately after the trim to make the comment correct. In fact this should go after the null byte removal as both of these parts are security related.

Steps to reproduce

Allow files with the htpasswd extension and then upload a file called .htpasswd

Proposed resolution

Always rename dot files.

Remaining tasks

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet

N/a