block_file_extensions.sh can be circumvented with fork + PR

[bloomonkey]

The block_file_extensions.sh pre-receive-hook can be circumvented by:

1. Fork the repository
2. Add a file with the blocked exension
3. Submit a pull request
4. Merge pull request

We've done a little research and suspect that this is due to the:

excludeExisting="--not --all"

I guess we could mitigate, e.g. by adding block_self_merge_prs.sh, but this could still be circumvented if 2 users with write privileges colluded.

Any thoughts?