[D7] Support RFC 5785 on Apache by whitelisting the .well-known directory

Well, if the ownership and permissions are correctly configured (which I assume they are on the testing clients) they won't have write access to drupal_mkdir(DRUPAL_ROOT . '/.well-known'); so that won't work.

The patch makes the same changes to .htaccess as the combined two D8 patches from the parent issue.

The regular expressions are the same as the ones that were already reviewed on the parent issue. I reviewed them again and they still look correct.

I repeated the tests that I ran locally on the parent issue, with the same successful results:

# patch -p1 < htaccess-no-tests-2847325-7.x.patch
patching file .htaccess
# check() { curl -I "http://localhost$1" 2>/dev/null | head -n 1; }
# check /
HTTP/1.1 200 OK
# check /.well-known
HTTP/1.1 403 Forbidden
# check /.well-known-not
HTTP/1.1 403 Forbidden
# mkdir -p .well-known/acme-challenge
# echo test > .well-known/acme-challenge/test
# check /.well-known/acme-challenge/test
HTTP/1.1 200 OK
# mkdir -p .well-known-not/acme-challenge
# echo test > .well-known-not/acme-challenge/test
# check /.well-known-not/acme-challenge/test
HTTP/1.1 403 Forbidden
# echo test > .some-other-name
# check /.some-other-name
HTTP/1.1 403 Forbidden

There's a separate issue #2699701: Testing RFC 5785 Support to add tests for this in D8, so I guess that would be backported separately when it's done...?

I can confirm this helped me get the letsencrypt system working on a site.

I can also confirm this worked for me + letsencrypt.

I believe it's time to commit this patch.

Drupal 7 should support Let's Encrypt out of the box too.

This allowed me to get LetsEncrypt/Certbot working. Thank you!

We're aiming to get this into next week's release.

Committed to 7.x - thanks!

I added a note about this to CHANGELOG.txt. Not sure if we want a change notice also? - there is one that was written for Drupal 8 at https://www.drupal.org/node/2661732 but it was never published because it has some problems.

As far as I can see, we're still blocking this for IIS servers in web.config, but it seems fine to fix it for Apache first. We should have a followup issue for IIS.

Eh, I was going to file an issue about IIS, but the web.config file is pretty different for Drupal 7 and Drupal 8 and I'm not even sure if it's being blocked there or not... so I'll leave that for someone else to do if it turns out to be an issue after all.