BUG Secure composer files from web access (fixes #8011)

Already applied to root .htaccess, but required for dynamically
generated file from installer as well. Also added upgrade instructions.