Disallow composer.json and composer.lock from being indexed

Problem/Motivation

As found in this post, composer.json files are indexed by search engines. This is not (necessarily) a security problem, but:

• it seems like a good idea to disallow users from finding a website with such search queries
• we can't think of a good reason why someone would want to access composer.json or composer.lock directly from the web
• malicious visitors could use the information in the files to start looking for vulnerabilities

Beta phase evaluation

Proposed resolution

Initially, we proposed either:

1. Disallowing search engines from indexing composer.json and composer.lock by adding them to robots.txt
2. Blocking access to composer.json and composer.lock using .htaccess and web.config

Looking at robots.txt, we did not see any lines which corresponded with blocking rules in .htaccess or web.config. Based on this precedent, we decided to only update .htaccess and web.config.

Remaining tasks

1. Decide on the path moving forwards.
   We decided to update .htaccess and web.config
2. Write a patch for D8.
3. Update patch to add tests.
4. Review and RTBC.
5. Commit to D8, set Status to Patch (to be ported), change Version to 7.x-dev.
6. Post patch to D7 (see #10).
   Note that @mparker17 could not find any automated tests in D7 that checked .htaccess rules.
7. Review and RTBC.
8. Commit to D7.
9. Decide if it's worth porting to D6?

User interface changes

None.

API changes

None