Try to adapt EndpointHandlerMapping so Actuator endpoints don't download f.txt

[dsyer]

See #4220 and the RFD vulnerability in Spring (patched in 4.2.3 and 4.1.9). We really don't need to be able to handle requests for paths like /trace.bat (or /trace.<anything>) so we don't need the default handler mapping behaviour for extensions (which now results in the confusing f.txt download for unknown or non-whitelisted extensions).

[philwebb]

A new fix for SPR-13587 will be added shortly that changes the header so that downloads are not triggered. This should hopefully solve the issue without needing any updates to Spring Boot.

[philwebb]

Fixed upstream and tested on Firefox

[dsyer]

This one also duplicates #4402 (I think).