fix: xss vulnerability in /api/raw (#2570)

[IceWreck]

Description

Fixed the XSS vulnerability reported by @febinrev in #2570

🚨 Before submitting your PR, please read community, and indicate which issues (in any of the repos) are either fixed or closed by this PR. See GitHub Help: Closing issues using keywords.

• DO make sure you are requesting to pull a topic/feature/bugfix branch (right side). Don't request your master!
• DO make sure you are making a pull request against the master branch (left side). Also you should start your branch off our master.
• DO make sure that File Browser can be successfully built. See builds and development.
• DO make sure that related issues are opened in other repositories. I.e., the frontend, caddy plugins or the web page need to be updated accordingly.
• AVOID breaking the continuous integration build.

Further comments

I experimented with quite a few policies and felt this is the least restrictive one while doing the job (allows browser previews etc to render while blocking all javascript and wasm inside any content returned by /api/raw - blocks execution of <script> or onclick etc).