Lockdown the PHP-FPM handler.

Prevent any possible PHP execution by explicitly defining the only PHP file that can be run (rather than a regex matching "any path ending in .php").