[patch] Harden app front-controller routing

[pennypacker-he]

Summary

• route Omeka Classic admin and install paths through their supported front controllers
• deny direct access to arbitrary PHP and Omeka database configuration files
• restrict OJS web execution to its public front controller
• add hosted container probes for application routes and protected paths

Local validation

• go test ./...
• bash -n for all new probe scripts
• git diff --check
• smoke tests intentionally left to GitHub-hosted CI