Check profile data being uploaded

[arroway]

To prevent uploads of malicious or unwanted content, we should checking on uploading that profile data match what is expected (format, content...)

[julienw]

Probably we can't check thoroughly the data before it's being uploaded to google storage, in the same server, for performance reason, so the currently planned architecture is that:

1. The data is uploaded to google storage in "private" mode. Nobody would be able to access this data, not even the uploader.
2. A request to check this data is pushed to a queue.
3. The data is checked by another background process.
4. If the data is deemed correct, its access control is switched to "public".

The process needs to be fast enough that the user doesn't have to wait more than 1 minute.

When we switch to a WebSocket architecture (issue TBD) we can provide progress updates to the uploader.

Things we can check:

• is it a a valid JSON format
• does that look like a profile
• image resolutions for screenshots (and others)