gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss