Backport security fixes from Firefox 115.3.1 to 115.3.0

Rather than do a whole rebase lets just cherry-pick the two commits from #42135 (closed)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information