[24.2] Set content-type to text/plain if dataset not safe

[mvdbeek]

We only care about XSS in the context of the webapp, and for that it is sufficient to set the content-type to text/plain.
We might be passing large secondary files through this which has performance implications.

Also adds a sanitization message and a loading indicator for the iframe content if we're hitting a preview route.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:

Create an HTML file with a tool that creates HTML files (multiqc, fastqc etc). Click on the eye icon and see that the file is displayed as text if it is not on the allow list. Hardcode content-type on line 647 to text/html to see that now it is rendered as html. Hardcode it back to text/plan and see it displayed as text.

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.