[Security][Proposal][WIP] Deny explicit requests to app.php/

Added check in app.php front controller in order to avoid explicit requests
being served by PROD env, except while Apache mod_alias redirect fallback.

Before:
```
GET http://localhost:8000/app.php/demo/hello/Fabien
HTTP/1.0 200 OK
```

After:
```
GET http://localhost:8000/app.php/demo/hello/Fabien
HTTP/1.0 404 Not found
```

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Doc PR        |

This approach tries to help with the obscurity about which framework is used in the app (app.php is publicly known as Symfony's front controller).
It's a proposal, any suggestion or comment are welcome.