blacklist .user.ini files

PHP-FPM uses .user.ini files to let users configure some settings, so it might be a good idea to blacklist those by default, just like for .htaccess files.