static-cat should be configurable per-user

[adehnert]

Right now, static-cat is configured globally, which means that it's hard when some user wants to allow some extension that we're reluctant to (like, say, hypothetically .txt --- #92, #319), and we need to balance the chance that somebody expects their .whatever file to be secret against other user's expectation that .whatever files should get served up. A static-cat (and associated infrastructure) that's easily configurable per-user (or per-directory) would help this.