Security: Forbid browsing of .git directory

[jkbzh]

Hi, although we don't manage your site, w3.org got a report related to your site for a potential security issue. Here's the fix for it.

Hi team

Description
.git repository exposed at https://w3id.org/.git/

Step

1. In your terminal type wget -mirror -I .git https://w3id.org/.git/
2. go to the downloaded file directory
3. git status
4. Deleted files will appear
5. git restore (any file)
6. check git log also

Impact
Attacker can restore deleted files and any of file consist of db user and
db password

Best regards
Manjot Singh

[davidlehn]

• Thanks. I don't think it was any security issue, since all the git data is available here on github anyway. But it's cleaner to not allow that.
• I put a block in the server config for now. When we eventually get Move hosted files and rules to ids/ directory. #3264 done, the .git dir would be outside of the web root dir making this patch not needed.
• Leaving this open for a bit. But probably will close unless someone thinks block should be in the root .htaccess too.