restrict access to public files only

use mod_rewrite to pretend theese files are not existend for security purposes

this would make the brances be used in production environment #12423
would suggest to merge this into stable7

allowed ocs compared to #12474
and with oc8 files within l10n need to b server by the web server as well - furthermore 3rdparty should be added to this list