Include X-Content-Type-Options (XCTO) header into API responses

See merge request gitlab/gitlabhq!2211

(cherry picked from commit 6c818e77f2abeef2dd7b17a269611b018701fa79)

e087e075 Include X-Content-Type-Options (XCTO) header into API responses