Backport of #8183 and #8197

Tested with litmus and manually

To test:
 - html files are delivered as `text/plain` over webdav
- `Content-Security-Policy` and other security headers are sent with webdav requests

cc @DeepDiver1975 @LukasReschke