(backport) Include X-Content-Type-Options (XCTO) header into API responses

See merge request gitlab/gitlabhq!2216

(cherry picked from commit 5fcb214f8527b3d58be1a833a596d01b1bf6119e)

40c6c9f4 Include X-Content-Type-Options (XCTO) header into API responses