Block direct access to ESDs

The `PHP` setting is the [default](https://github.com/shopware/shopware/blob/0449093fb28bfb7c65909c136e5a6af2f2cf8c64/_sql/migrations/231-update-redirectDownload-config-var.php#L16) anyways, so restricting direct access should not be a problem.
Ah ok, just found [that](https://github.com/shopware/shopware/blob/247d5c20d34f97fec967a8489fd18ad57e89c837/_sql/install/latest.sql#L1912). This snippet is from a config of a project which we started with Showare `4.1.3` where the default was sill `/files/esds/` (and was never changed, since we blocked access from the beginning).

So yes, it should be merged with the new default path!