fix: harden CMS security controls

cms/data/.htaccess

@@ -0,0 +1,2 @@
+# NeoCMS metadata may contain drafts and revision history; never serve it directly.
+Require all denied

cms/data/index.php

@@ -0,0 +1,3 @@
+<?php
+// Metadata is private even when a web server ignores the accompanying .htaccess file.
+http_response_code(404);