fix(htaccess): serve .json and .ftl files statically instead of routing them to the front controller

The bundled pdf.js of files_pdfviewer loads its localization from
apps/files_pdfviewer/js/pdfjs/web/locale/locale.json and
apps/files_pdfviewer/js/pdfjs/web/locale/<lang>/viewer.ftl.

With pretty URLs enabled, both extensions are missing from the static file
exclusion of the generated front controller rule, so Apache passes the
requests to index.php, which answers 404. pdf.js then fails to initialize
and shows the alt text dialog instead of the document.

Our nginx reference configuration serves both through try_files, and so does
an Apache instance without pretty URLs, so this only brings the pretty URL
case in line with the other two.

To not widen what is reachable in the process, the package manager metadata
that the nginx configuration explicitly returns 404 for is now denied in
.htaccess as well.

Resolves: #63512
Signed-off-by: Stefan - ByteSide.io <sr@byteside.io>

Author: ByteSide

.htaccess

@@ -140,6 +140,16 @@
 
     RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
 
+##
+## Rule: Prevent access to package manager metadata and our shipped app list
+##
+## Context:
+##    - Mirrors the equivalent `return 404` of our nginx reference configuration
+##    - Required because `.json` is excluded from the front controller rule
+##      generated by `lib/private/Setup.php`, so these would otherwise be served
+##
+    RewriteRule ^(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ - [R=404,L]
+
 ##
 ## Rule: Maps most RFC 8615 compliant well-known URIs to our main frontend controller (/index.php) by default
 ##

lib/private/Setup.php

@@ -614,7 +614,7 @@ public static function updateHtaccess(): bool {
 			$content .= "\n  Options -MultiViews";
 			$content .= "\n  RewriteRule ^core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]";
 			$content .= "\n  RewriteRule ^core/preview.png$ index.php [PT,E=PATH_INFO:$1]";
-			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
+			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|json|ftl|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/ajax/update\\.php";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/img/(favicon\\.ico|manifest\\.json)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/(cron|public|remote|status)\\.php";