Change Mahara's content-sniffing to match the WHATWG standard

[Aaron Wells]

WHATWG (Web Hypertext Application Technology Working Group) is basically the official specification organization for HTML5. They've written up some specifications about the correct & secure way that HTTP clients & servers ought to deal with file content types aka MIME types: https://mimesniff.spec.whatwg.org

[Aaron Wells (u-aaronw)]

For comparison, Mahara's current system is basically:

1. Examine the file suffix of the file and see if it matches one in our list
2. If that doesn't work, try it using the PHP finfo() command (which relies on libmagic's "magicdb" file)
3. If finfo is not available, or we can't find the magicdb file, try it using the PHP mime_content_type() command (which relies on the system's "magic.mime" file.
4. If that doesn't work, return the generic "application/octet-stream".

We also try to mitigate the possible threat posed by incorrect Mimetypes, by adding "Content-Disposition: attachment" to files unless they're being served inline (like the "src" of an image tag, or an HTML5 audio/video), to try to prevent the browser from handling the file directly.