Merge "Prevent exfiltration of system files via avatar picker." into sc-dev