Add config for reducing MIME type security risks

For compatibility reasons (e.g.: legacy servers that serve all files
as `text/plain`), IE 8+ has a MIME-sniffing feature that will attempt
to determine the content-type for each downloaded resource.

In some cases, IE may report a MIME type different than the type speci-
fied by the web server. For instance, if IE finds HTML content in a file
delivered with the HTTP response header `Content-Type: text/plain`, it
determines that the content should be rendered as HTML.

Unfortunately, MIME-sniffing can also lead to security problems for
servers hosting untrusted content.

Fortunately, IE provides web apps with the ability to opt-out of
MIME-sniffing by sending the `X-Content-Type-Options` response header
with the value `nosniff`. This will prevent IE from MIME-sniffing a
response away from the declared content-type.

See also:
* http://msdn.microsoft.com/en-us/library/ie/gg622941
* http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

Beside IE 8+, this feature has been implemented in Chrome, and may soon
come to Firefox (https://bugzilla.mozilla.org/show_bug.cgi?id=471020).

Ref: h5bp/server-configs-apache#8.