Stop recommending deprecated CSP directive `plugin-types` in the content repository part of the spec

The `plugin-types` directive was removed from CSP, both [in the web spec](https://github.com/w3c/webappsec-csp/issues/394) and in Chrome/Chromium. Firefox [never implemented](https://bugzilla.mozilla.org/show_bug.cgi?id=1045899) this.

Previously, a valid use for it was to specify `plugin-types: application/pdf` since `object-src: 'none'` disallowed rendering PDFs in some browsers using the browser's built-in PDF renderer (notably this was the case for Chrome). This is also why we started doing it and [recommending it](https://spec.matrix.org/unstable/client-server-api/#content-repository). Supposedly another workaround for this was to add `rel="noreferrer"` (see: ).

Since support for this was removed, hopefully this shouldn't be a problem anymore. We should test whether it's still happening. If not, we should just switch to using/recommending `object-src: none` instead. If it's still happening, we should investigate whether there's another workaround we can use.

Start with the content repository section of the Matrix specification and review the linked CSP and browser references. Test whether object-src: 'none' still prevents built-in PDF rendering; done means removing the plugin-types recommendation and recommending object-src: 'none' if the problem is gone, or documenting an alternative workaround if it remains.

Written by the indexing model from the issue text.