Block access to package-lock.json files

Problem/Motivation

Since #3308369: Block access to yarn.lock and package.json we block access to yarn.lock.
Core only uses Yarn and does not have a package-lock.json but custom themes could use NPM and have this lock file so it could make sense to also block access to it as a hardening.
For example gin has one: https://git.drupalcode.org/project/gin/-/blob/5.0.x/package-lock.json?re...

Steps to reproduce

1. Install gin.
2. Browse to /themes/contrib/gin/package-lock.json.

Proposed resolution

Add package-lock.json to this rule in .htaccess: https://git.drupalcode.org/project/drupal/-/blob/5674bcd77c27bbc82ed92bb...

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Drupal's .htaccess now blocks HTTP access to package-lock.json, alongside the existing protection for package.json and yarn.lock.

Core uses Yarn and does not produce a package-lock.json itself. Contributed or custom themes and modules that use npm can have one.

Sites with a customized .htaccess (including scaffold-managed sites that override the scaffolded file) need to apply the same change: replace package\.json with package(-lock)?\.json in the FilesMatch rule.