Lock down the uploaded files a bit in default Apache configs.

The generated Apache configs now set some defaults that limit what can
be done in the uploaded directories. It prevents a .htaccess from
overriding settings, prevents other modules like php from executing, and
also sets some file types to appear as plaintext so that the browser
won't render them.

This is not a complete solution for protection against malicious files.
Older versions of IE don't care what mimetypes we use and will sniff for
HTML files, for instance. It's really up to the administrator to do some
heightened security precautions, which will be outlined in a KB article
separately.