(security-9-2) Upload files into `public/upload/system` instead of `public/upload`

See merge request !2104

Conflicts:
  app/validators/dynamic_path_validator.rb

Fixed conflicts based on 3c7c859c359bf5d3955dd300d6861ff33af21ca7