docs: block access to metadata files in nginx sample configs

The nginx sample configs served top-level metadata files (composer.json,
composer.lock, package.json, package-lock.json, core/shipped.json) as plain
files, since they matched neither a 404 block nor the static-asset extension
list and fell through to `try_files $uri`. This leaked dependency information.

Add a 404 location block matching these files to both the root and subdir
sample configs, alongside the existing rules that hide non-public paths.

Fixes #15101

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>

Author: szaimen

admin_manual/installation/nginx-root.conf.sample

@@ -1,5 +1,5 @@
 # Nextcloud nginx configuration — root installation
-# Version 2026-03-26
+# Version 2026-06-09
 
 # PHP-FPM backend.
 upstream php-handler {
@@ -152,6 +152,10 @@ server {
     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
     location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
 
+    # Hide metadata files which would otherwise be served as plain files and
+    # leak dependency information (composer.json, package.json, core/shipped.json).
+    location ~ ^/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
     # Pass PHP requests to PHP-FPM.
     #
     # Important: this block must appear above the static asset locations

admin_manual/installation/nginx-subdir.conf.sample

@@ -1,5 +1,5 @@
 # Nextcloud nginx configuration — subdirectory installation (/nextcloud)
-# Version 2026-03-26
+# Version 2026-06-09
 
 # PHP-FPM backend.
 upstream php-handler {
@@ -152,6 +152,10 @@ server {
         location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)    { return 404; }
         location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console)                  { return 404; }
 
+        # Hide metadata files which would otherwise be served as plain files and
+        # leak dependency information (composer.json, package.json, core/shipped.json).
+        location ~ ^/nextcloud/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
         # Pass PHP requests to PHP-FPM.
         #
         # Important: this block must appear above the static asset locations