Backport of #8183 to stable6

Some headers were currently only added to the templates but not to
other components (e.g. SabreDAV / JSON / etc...)
The migration to base.php ensures that the headers are served to all
requests passing base.php
Backport of #8197 to stable6

This extends mimetypes.list.php to be a white-list of known secure mime
types as well as offering secure alternatives for know potentially
malicious mime types.
I kept this in the OC_Helper and OC\Files\Type\Detection classes as
each backend has its own way of detecting mime types.

This supersedes #8184 as discussed in owncloud/security-tracker#56
Merge pull request #8260 from owncloud/stable6-backport-8183-and-co

Backport of #8183 and #8197