Prevent YAML access in IIS by default (fixes #8233)

Since SS3 keeps values in configuration, direct access
to known paths might expose them