Block direct access to ESDs

The `PHP` setting is the [default](https://github.com/shopware/shopware/blob/0449093fb28bfb7c65909c136e5a6af2f2cf8c64/_sql/migrations/231-update-redirectDownload-config-var.php#L16) anyways, so restricting direct access should not be a problem.