fix(lagoon/attach): StaticHandler sends the stored Content-Disposition and nosniff (quick-261105-oc8)

- attach.StaticHandler and attach.StaticHandlerPublic set X-Content-Type-Options: nosniff on every response
- the stored disposition is read with one Attributes call after the is_public gate and sent on GET and HEAD; a value mime.ParseMediaType rejects is sent as attachment
- blobs without a stored disposition are served as before
- lagoon README, storage and attachments docs pages, surf uploads comment updated

modules/surf/uploads.go

@@ -35,9 +35,9 @@ const uploadsContentSecurityPolicy = "default-src 'none'; img-src 'self'; media-
 // (attach.IsInlineContentType) is served as an attachment: attach.Store
 // records the type sniffed from the bytes, so an uploaded text file that
 // starts with <html> is text/html. attach.Store also stores the attachment
-// disposition with the blob, but the route still decides from the type on
-// every response: attach.StaticHandlerPublic sends only the stored type, and
-// blobs written earlier or outside attach.Store carry no disposition. The
+// disposition with the blob and attach.StaticHandlerPublic sends it, but the
+// route still decides from the type on every response, because blobs written
+// earlier or outside attach.Store carry no disposition. The
 // bucket and the database are looked up per request: boot and route:list
 // build the router before serve publishes either.
 // The route owns the whole prefix: a plugin route at or under it fails