disallow access to dotfiles besides .well-known by default

questions i stumbled upon:

• use prefix match instead of regex?
  • takes higher precedence
  • only overwritable by more specific match

closes https://git.cccv.de/infra/documentation/-/issues/115

defaults/main.yml

@@ -45,6 +45,7 @@ nginx_vhosts_defaults:
   add_proxy_headers: {}
   hide_proxy_headers: {}
   backend: ~
+  disallow_dotfiles: True
 
 nginx_streams_defaults:
   listen: