disable access on pem files (private keys)

e.g. in core/tcpdf/ there is a tcpdf.pem which should not be downloadable