Block access to .yaml files as well as .yml
Merge remote-tracking branch 'origin/3.0' into 3.1