[Security] Hidden front controller for Nginx

For Nginx in PROD env, this makes more difficult to know that app is running Symfony.

app.php is widely known as our default front controller.
It is a small effort by security through obscurity.
For Apache, [this 301 must be replaced by 404](https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37).

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New feature?  | no
| Applies to    | 2.0+
| Tests pass?   | yes
| Fixed tickets |