Block all requests to hidden files in Nginx
Block all requests to config files.

PHP wouldn't display the config anyway, but let's block it just
to be safe.
Merge branch 'master' of github.com:Automattic/vip-quickstart