[IMP] core: mark all responses as nosniff

Doesn't seem like it could hurt, and should only make CORB more
reliable by avoiding sniffing. Worst case scenario requires fixing a
few mimetypes, but aside from CORB it looks like modern (non-IE)
browsers only try to guess document mimetypes in very limited
contexts.

closes odoo/odoo#107957

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

odoo/http.py

@@ -2051,6 +2051,8 @@ class Application:
 
     def set_csp(self, response):
         headers = response.headers
+        headers['X-Content-Type-Options'] = 'nosniff'
+
         if 'Content-Security-Policy' in headers:
             return
 
@@ -2059,7 +2061,6 @@ class Application:
             return
 
         headers['Content-Security-Policy'] = "default-src 'none'"
-        headers['X-Content-Type-Options'] = 'nosniff'
 
     def __call__(self, environ, start_response):
         """