This must be done on the server, by setup a hook within Gitblit. Check one of the provided post-receive hooks. A post-receive hook is run by the server after the push data has been received, and if it returns false the push will be rejected.
When the script will get invoked you get a list of refs, see in the example how to get the list of commits
This should get you started to get a list of the files contained in the push:
def commits = JGitUtils.getRevLog(repository, command.oldId.name, command.newId.name)
for commit in commits:
def diffs = git.diff().setNewTree(commit.getTree())
.setOldTree(commit.getParent(0).getTree())
.call();
for diff in diffs:
def path = diff.getOldPath();
//check the extension on the path, and return false to reject the push