WIP: Specify Content-Disposition and Content-Type semantics on /download and /thumbnail

[turt2live]

Likely better with #1756

See matrix-org/matrix-spec-proposals#2702
See matrix-org/matrix-spec-proposals#2701

TODO:

• Render Content-Disposition header as existing in the spec.
• Render x-[changed|added]InMatrixVersion for Content-Type and Content-Disposition.
• Decorate /download with Content-Disposition requirements from MSC2702
• Consider applying the same treatment to /download as Factor out all the common parameters of the various /relations apis #1745
• Spec MSC2701 while we're here
• Changelog(s)

Preview: https://pr1758--matrix-spec-previews.netlify.app

[tulir]

The conduwuit devs implemented content type sniffing recently as they weren't sure if it's safe to trust user input there (and weren't aware of MSC2701 at the time). I think the spec should have some words explaining why it's safe, and particularly the interaction between content-type and content-disposition (disposition must be derived from the same type that is served, using different values opens security issues)