uploads: disallow more video formats not supported by all browsers.

Disallow uploading videos with 10-bit color or 4:4:4 chroma subsampling.
Neither of these features are supported by Firefox.

Only 8 such videos have been uploaded to Danbooru:

* https://danbooru.donmai.us/media_assets/3070695 (4:4:4)
* https://danbooru.donmai.us/media_assets/3070697 (4:4:4)
* https://danbooru.donmai.us/media_assets/3292518 (4:4:4)
* https://danbooru.donmai.us/media_assets/3358659 (10-bit)
* https://danbooru.donmai.us/media_assets/3358660 (10-bit)
* https://danbooru.donmai.us/media_assets/3730866 (10-bit)
* https://danbooru.donmai.us/media_assets/5056665 (10-bit)
* https://danbooru.donmai.us/media_assets/5479605 (4:4:4)

Note that Exiftool doesn't output this information, so it's not in the
EXIF metadata. We have to reply on ffprobe at upload time instead.

Followup to #3615.

app/logical/ffmpeg.rb

@@ -83,6 +83,10 @@ class FFmpeg
     frame_count / duration
   end
 
+  def pix_fmt
+    video_stream[:pix_fmt]
+  end
+
   def video_codec
     video_stream[:codec_name]
   end

app/logical/media_file/video.rb

@@ -5,7 +5,7 @@
 #
 # @see https://github.com/streamio/streamio-ffmpeg
 class MediaFile::Video < MediaFile
-  delegate :duration, :frame_count, :frame_rate, :has_audio?, :video_codec, :video_stream, :video_streams, :audio_streams, to: :video
+  delegate :duration, :frame_count, :frame_rate, :has_audio?, :pix_fmt, :video_codec, :video_stream, :video_streams, :audio_streams, to: :video
 
   def dimensions
     [video.width, video.height]
@@ -21,6 +21,17 @@ class MediaFile::Video < MediaFile
     return false if is_webm? && metadata["Matroska:DocType"] != "webm"
     return false if is_mp4? && !video_codec.in?(["h264", "vp9"])
 
+    # Only allow pixel formats supported by most browsers. Don't allow 10-bit video or 4:4:4 subsampling (neither are supported by Firefox).
+    #
+    # yuv420p:  8-bit YUV, 4:2:0 subsampling. The vast majority of videos use this format.
+    # yuvj420p: 8-bit YUV, 4:2:0 subsampling, color range restricted to 16-235. Uncommon, but widely supported.
+    # yuv444p:  8-bit YUV, 4:4:4 subsampling (i.e. no subsampling). Uncommon, not supported by Firefox.
+    # yuv420p10le: 10-bit YUV, 4:2:0 subsampling (i.e. 10-bit video). Uncommon, not supported by Firefox.
+    # gbrp: 8-bit RGB (used by VP9). Uncommon, but widely supported.
+    #
+    # https://github.com/FFmpeg/FFmpeg/blob/master/libavutil/pixfmt.h
+    return false if !pix_fmt.in?(%w[yuv420p yuvj420p gbrp])
+
     true
   end