14.4 section (HTTP Security Headers) rename / find better category-section for "content-type" requirements.

[elarlang]

After browser-related requirements are moved away, there will be only 2 requirements left behind (as those are not that browser-specific and are required for other clients as well)

V14.4 HTTP Security Headers

#	Description	L1	L2	L3	CWE
14.4.1	[MODIFIED, SPLIT TO 14.4.8] Verify that every HTTP response contains a Content-Type header which matches the actual content of the response.	✓	✓	✓	173
14.4.8	[ADDED, SPLIT FROM 14.4.1] Verify that if a response specifies a Content-Type of "text/*", "*/*+xml" and "*/xml", it also specifies a safe character set (e.g., UTF-8, ISO-8859-1) with the charset parameter.	✓	✓	✓	173

Now - the section title is misleading. Also think those requirements should not belong to the Configuration category.

[elarlang]

The change is done now: https://github.com/OWASP/ASVS/blob/master/5.0/en/0x22-V14-Config.md#v144-http-security-headers

Note: the initial idea was to move those (14.4.1 and 14.4.8) requirements to the section "Unintended Content Interpretation": https://github.com/OWASP/ASVS/blob/master/5.0/en/0x50-V50-Web-Frontend-Security.md#v505-unintended-content-interpretation

[tghosth]

Ok so I feel like these should not strictly belong to the browser category because they could be relevant to other apps which pull resources via HTTP.