Are ripple validation nodes appointed by central authority?
No. Nobody has any particular right to tell anyone what validators to use or listen to.
If not, what prevents 51% attack through validator nodes?
It depends what you mean by a 51% attack. If you mean a case where validators refuse to agree, then a 51% attack would cause the attacked node to fail to make forward progress. In that case, one would hope the operate of that node would stop listening to the validators that are causing the problem. Validators sign every statement they make, so this is not difficult to detect.
A 51% attack on the XRP Ledger is extremely unlikely because it doesn't allow a double spend. It just stops forward progress. So some group would have to convince people to listen to their validators only to lose any credibility they had gained the first time they attempt such an effort.
We would expect users to choose validators based specifically on how unlikely they are to collude to DoS the network. So you would have to have someone go to all the effort to convince people they're not likely to do the very thing they intend on doing, and all they get out of it is perhaps a short term denial of service on the network and then they lose everything they worked to build. It's extremely unlikely such a thing would ever happen, simply because it's so much work to do and you have so little to show for it.
Why ripple.txt file contains validation nodes list?
If users just want the system to work and don't particularly care how two valid but conflicting transactions received at about the same time are resolved, they can just use the default list. If it stops working, then they can change it.
Who maintains this list?
Whoever publishes that file. Anyone who wants to can publish such files.
What is incentive for users to run validator nodes?
Roughly the same as running a bitcoin full node. If you're running an XRP Ledger node anyway, the additional cost to run a validator is effectively zero. It doesn't get you any special powers, just as running a bitcoin full node doesn't, but it does help to keep the network stable and resistant to DoS attacks. People who want the network to be stable and resist DoS attacks will have an incentive to run a validator.