Various JSON config / package files are reachable via a GET request #18128

It seems that various JSON configuration files are easily viewable by requesting them with a simple GET request. Some examples of these are:

• matomo-domain.example.com/plugins/AbTesting/plugin.json
• matomo-domain.example.com/plugins/CustomVariables/plugin.json
• matomo-domain.example.com/package-lock.json

Some various files I've observed:

• composer.json
• plugin.json
• package-lock.json

There could be useful to an attacker trying to monitor the patch version of Matomo sites, so the access settings should be made less permissive so that JSON files aren't as open to the web.

A useful command to enumerate over these from the core project is
find ./ -iname '*.json' | egrep -v '(vendor|lang|node_modules)'

FYI noticed originally json was added to fix some tests in https://github.com/matomo-org/matomo/commit/903b870466b62e8a655a0f6564d052583c0fb7ec#diff-dddd74c8019f3e240dad1e60bc6ffbdd906ad7fa396b3e272a493f5b4af0c5c7

I suppose we could check through all the tests and see if we can maybe remove json now. package-lock.json we'll soon actually remove from the release directly but then they might still exist when someone uses submodules (which we do in some places so far). Possibly could otherwise also just specifically disallow some json files like plugin.json and package.json etc