Nginx docs for denying composer file access (fixes #8011)