[ISSUE]: Inconsistent Content-Type validation between backend modules #523

Description

There are multiple Content-Type validators (backend/security_parsers.py: validate_content_type / backend/middleware.py: validate_content_type_middleware / safe_request_handler inside same middleware). They don’t behave identically:
validate_content_type() checks request.content_type against allowed types and errors on missing header.
validate_content_type_middleware lowercases and strips parameters, but error message hardcodes “Expected: application/json”.
safe_request_handler builds a different allowed list depending on require_json.
This inconsistency can lead to endpoints behaving differently

Additional Context

Steps to reproduce:
Add/choose an endpoint that uses validate_content_type_middleware.
Send a request with header: Content-Type: application/x-www-form-urlencoded; charset=utf-8
Observe whether it is accepted/rejected.
Repeat against an endpoint using safe_request_handler(require_json=True) or different decorator ordering.
Compare responses—behavior will differ even though Content-Type is essentially “the same” header.