This matches the previous default (network.mime.sniff off) behaviour in all
but one case: we will now accept a font without a `Content-Type` header, which
would previously have been ignored.