Add ability to define a 'canDownload()' method on a custom File DataExtension

- If a FileExtension includes a canDownload() method, then use the boolean
output from that extension to determine access rights. If there are no
FileExtension objects with canDownload() set, then fallback to using the
existing canView() permission checks.

- Abstracts the permission checking working into
SecureFileController::canDownloadFile() rather than directly in handleRequest().

- Fixes bug where the Security::permissionFailure() call fails because no
SS_HTTPResponse object exists.

- Remove silverstripe/cms from composer require, add to suggests instead.