[DSE-2456] return html as plain text
[DSE-2456] return html as plain text

To address the possibility of an XSS attack, we shouldn't
render html files within a project as html when they're being
accessed through the api /projects/files/file_name.html route.

Returning them as text/plain ensures no changes to the resulting
text, but don't render it in the browser. This seems to be similar
to what github does when you

The pen testers recommended solving this by wrapping files in json.
This is suitable for text only responses, but we use the same api mechanism
for serving images, binary files (if a user has them) etc. We will reach out
to the pen testers, but this does seem to accomplish the same goal without
risking any major breakage in our file serving process.

SensePlatform/vfs-http-adapter