Check serving constraints of WebBundle responses

This adds check for the serving constraints of WebBundle responses [1].
After this patch, subresource web bundles served without the following
response headers will be rejected.

- Content-Type: application/webbundle
- X-Content-Type-Options: nosniff

[1] https://wicg.github.io/webpackage/draft-yasskin-wpack-bundled-exchanges.html#name-serving-constraints

Bug: 1176493
Change-Id: I03adef6bad769dfd69fdad76c933f701679c118e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2691792
Commit-Queue: Kunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: Tsuyoshi Horo <horo@chromium.org>
Reviewed-by: Hayato Ito <hayato@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Karan Bhatia <karandeepb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#854600}

web-bundle/resources/wbn/cors/__dir__.headers

@@ -1,2 +1,3 @@
 Content-Type: application/webbundle
+X-Content-Type-Options: nosniff
 Access-Control-Allow-Origin: *

web-bundle/resources/wbn/no-cors/__dir__.headers

@@ -0,0 +1,2 @@
+Content-Type: application/webbundle
+X-Content-Type-Options: nosniff