infer content type from contents of file instead of its file extension

Overview:
* always set content-type of file uploads on the server, sensible default if no type can be retrieved
* sensible default is `application/binary` as it's more secure than `octet-stream` (see: http://security.stackexchange.com/q/12896)
* set `nosniff` header when displaying attachments to instruct browsers not to guess content type

Details:
* ruby's Mime::Types gets content types by file extensions, that's not enough 
* uses file command to cross-check proposed content types by Mime::Types
* Redmine uses special mime-types, use them when above checks succeed
* some controller cleanup as we can assume that content_type is set (after_initialize defaults to sensible default for attachments already in the database that don't have a content type)

[``* `#1725` Content-sniffing-based XSS for attachments``](https://www.openproject.org/work_packages/1725)