Allow createSite to ingest remote build.files URLs during imports

[Copilot]

createSite currently rejects URL-valued build.files entries even though multiple importers emit that shape for images. As a result, any import carrying remote image assets fails at site creation with Invalid file import payload in build.files.

• Route remote file imports correctly

  • Split build.files validation in createSite into two cases:
    • staged local files: continue requiring a valid bulk-import staged path
    • remote http(s) URLs: allow them through to the existing remote-download save path
  • Preserve the existing extension allowlist for both paths

• Keep bulk-import hardening intact

  • Leave staged-path validation strict for local bulk imports
  • Do not relax the existing tmp/imports boundary checks or scheme rejection in the staged-path helper

• Use the existing network safety controls

  • Remote URLs now flow through HAXCMSFile.save() instead of being rejected up front
  • That keeps SSRF protection and existing download safeguards in one place rather than duplicating importer-specific behavior

• Harden filename handling for remote saves

  • Add defensive fallback naming when an imported file object does not carry originalname
  • This avoids crashes on URL-backed imports while keeping the save path deterministic

• Coverage

  • Add focused tests for:
    • accepting URL-valued build.files entries
    • preserving rejection of non-staged local paths
    • fallback filename behavior for remote imports

const location = build.files[fileName];
const isRemote = /^https?:\/\//.test(location);

if (isRemote) {
  // allow remote download path; SSRF checks happen in HAXCMSFile.save()
} else if (!HAXCMSFile.isValidBulkImportStagedPath(location)) {
  return res.status(400).send({ reason: "Invalid file import payload in build.files" });
}

• Fixes #3060