Update .htaccess

Sync with Pico 1.0.3; see ee5b4f0

.htaccess

@@ -3,8 +3,9 @@
     # May be required to access sub-directories
     #RewriteBase /
 
-    # Deny access to internal dirs by passing the URL to Pico
-    RewriteRule ^(.git|config|content|content-sample|lib|vendor)(/|$) index.php [L]
+    # Deny access to internal dirs and files by passing the URL to Pico
+    RewriteRule ^(\.git|config|content|content-sample|lib|vendor)(/|$) index.php [L]
+    RewriteRule ^(CHANGELOG.md|composer.(json|lock)) index.php [L]
 
     # Enable URL rewriting
     RewriteCond %{REQUEST_FILENAME} !-f