Attachment name used in temporary local file leads to invalid filenames

[jwhitlock]

When an attachment exceeds 150KB, it is written to disk rather than held in memory:

fx-private-relay/emails/views.py

Lines 748 to 752 in 04fbbdd

	attachment = SpooledTemporaryFile(
	max_size=150*1000, # 150KB max from SES
	suffix=extension,
	prefix=os.path.splitext(fn)[0]
	)

The prefix and suffix come from the attachment name, which is user-provided and may not result in a valid filename, and an error when the contents are written to disk.

We should not base the filename on text from the incoming email, and should double-check that these files are closed at the end of the request to free disk space.