API Filter composer files in IIS and Apache rules (fixes #8011)

They can expose version information, so shouldn't be accessible
through the web. The better solution of course is to move
to a public/ subfolder application structure.