Update the Drupal sample app configuration

[catplat]

Why

Closes #5175

What's changed

Update the top-level rule in sites/platform/static/files/fetch/appyaml/drupal10

Where are changes

http://localhost:1313/guides/drupal/deploy/configure.html#configure-apps-in-platformappyaml

Updates are for:

• platform (sites/platform templates)
• upsun (sites/upsun templates)

[github-actions]

Your Upsun Fixed environment has successfully deployed. 🚀

See the site:

• Upsun Fixed docs
• Upsun docs

[dman-coders]

First iteration had a few issues.

• don't add the extra nesting under web - it's invalid there
• Don't remove passthru - it's needed for the app
• Don't remove the exceptiojn for access to css and other safe files - they are all normal and need not be blocked.

It's only PHP scripts that we are refining the execution rules for. I have a replacement forthcoming ...

[dman-coders]

Tested the repaired version.
confirmed that index.php, install.php work, and access to css, including aggregated css works.
update.php and /core/rebuild.php are also accessible
confirmed that now sites/default/settings.php is disallowed
confirmed tha an arbitrary script like phpinfo.php is NOT allowed - this was the intent.
Going back to the endpoints I tested and reported in the original issue.
https://linear.app/platformsh/issue/ADV-2168/upsun-fixed-update-the-sample-drupal-app-configuration#comment-31e32bac

... OK, all the misc php files that were accessed incorrectly before are now blocked (good)
all the functionality we know we need remains (good)

[dman-coders]

After reviewing together, this is valid and works.
Arbitrary php files are now disallowed (404) and required php pages are allowed still.
Correct behaviour now.

I actually tested this file on real deployments