Previously, when files within extensions were served from various endpoints, the content type was deduced from the file type without any explicit security measure.

This could lead to XSS attacks.

This PR does the following:

• add strict http headers whenever a user controlled input is served directly
• correctly set content type / disposition / cache control when uploading the the configured cloud storage provider

The following protections are added:

• X-Content-Type-Options: nosniff to prevent browsers from guessing the content type
• strictest possible Content-Security-Policy when serving user controlled input
• Content-Type: text/plain for certain files whose source can be viewed (preventing rendering)
• Content-Type: application/octet-stream for remaining files
• Content-Disposition: attachment for files that can not be viewed to prevent inline rendering

application/json and application/xml are kept as is, to allow rendering them in the browser in a convenient way