Fix #514

[RobertoPrevato]

• Fix #514 — add support for
  multiple request body formats on a single endpoint.

  • New MultiFormatBodyBinder: holds an ordered list of inner BodyBinders and
    dispatches get_value to the first whose matches_content_type returns True.
    Returns HTTP 415 Unsupported Media Type when the binder is required and no
    inner binder matches the request's Content-Type.

  • Union annotation syntax — the normalization layer detects a union of
    body-binder BoundValue types and automatically builds a
    MultiFormatBodyBinder:

    async def create_item(data: FromJSON[Item] | FromForm[Item]) -> Item: ...
    # optional variant
    async def create_item(data: FromJSON[Item] | FromForm[Item] | None) -> Item: ...

  • New FromBody[T] convenience type: equivalent to
    FromJSON[T] | FromForm[T], useful when you want to accept both structured
    formats without being explicit:

    async def create_item(data: FromBody[Item]) -> Item: ...

  • New FromXML[T] and XMLBinder: parse application/xml / text/xml
    request bodies using defusedxml,
    protecting against XXE injection, entity expansion (billion laughs),
    and DTD-based attacks. Security exceptions propagate unmodified so the
    application can distinguish attack attempts from ordinary malformed input.
    Install the extra with pip install blacksheep[xml].

  • All new types compose freely:

    async def create_item(data: FromJSON[Item] | FromXML[Item] | FromForm[Item]): ...

  • OpenAPI Specification is generated correctly for all combinations: each
    accepted content type appears as a separate entry under requestBody.content,
    all referencing the same schema.

See https://github.com/Neoteroi/BlackSheep-Examples/tree/main/content-types