Use secure mimetype for content delivery

Adds some hardening against potential CSP bypasses. Without this our CSP protection might be bypassed by an authenticated user.

Testplan:

- [ ] Upload a "test.js" file and download it via the web interface. Mimetype while downloading should be `text/plain`
- [ ] Upload a `test.odt` file and download it via the web interface. Mimetype while downloading should be `application/vnd.oasis.opendocument.text`

@karlitschek This might be worthwhile backporting to stable7. - I don't think this is something for stable6 though.
@icewind1991 as discussed