set X-Content-Type-Options to nosnif for jsonp responses

result of the conversations from [#1766](https://github.com/spumko/hapi/pull/1766/files#r15191632)

specifically

> This would have prevented the ... vulnerability too ... and it might prevent similar attacks that bypass the /**/-based protection in the future