security: disable access to /data

The xml content was publicly accessible through <url>/data/content-ma/..
- moved ‘leerlijnen’ folder to /index
- server: removed link ‘data’ from /var/www
- apache: add rewrite to allow access to images and other resources