Return a 404 for legitimately missing files

Right now we only check if a file is visible from a DB state AND exists
in the clean-uploads path, else redirect to placeholder.

This has a nasty side effect in that a legitimately missing file will
behave like it's being virus checked.

Now we look in the incoming-uploads path, and only return a placeholder
if the file being asked for is in there (e.g is actually being virus
checked). All other requests for missing files are a 404.
WIP