coverity: http: use fstat() instead of stat() to make sure IMS hits
works right in the rather unlikely scenario of a static file getting
replaced during request handling.