Return "application/octet-stream" as hardocded mimetype

While this has some disadvantages (e.g. Nautilus won't show applications that can open the filetype) it is the only reliable way to prevent a CSP bypass. A `Content-Disposition` header forcing the browser to download the filetype will prevent potential XSS but not the CSP bypass.

According to @danimo the client does not use the returned `Content-Type`.

Please review @DeepDiver1975 @karlitschek