Fix .git block: RedirectMatch/FilesMatch are not honored on this LiteSpeed vhost, use mod_rewrite instead

The docRoot is the git working tree, so .git/ was directly downloadable
over HTTPS (curl https://orbis.orbishosting.com/.git/config returned 200),
exposing the origin remote URL with an embedded GitHub personal access
token in plaintext. Added a .htaccess denying dotfiles/.git and a
matching OpenLiteSpeed vhost context as defense in depth. The exposed
token should be revoked/rotated on GitHub regardless of this fix.

.htaccess

@@ -0,0 +1,10 @@
+# Block direct web access to the .git directory and other dotfiles.
+# The .git folder lives inside public_html (docRoot) and was found to be
+# directly downloadable over HTTPS (e.g. https://orbis.orbishosting.com/.git/config),
+# which leaked a live GitHub personal access token embedded in the remote URL.
+# Note: standard Apache access-control directives (RedirectMatch, FilesMatch/
+# Require all denied, Order/Deny) are silently ignored on this LiteSpeed vhost.
+# Only mod_rewrite rules are honored (confirmed via testing), hence this form.
+RewriteEngine On
+RewriteCond %{REQUEST_URI} ^/\.git
+RewriteRule .* - [F,L]

config/vhost/vhost.conf

@@ -62,6 +62,11 @@ rewrite  {
   autoLoadHtaccess        1
 }
 
+context /.git {
+  location                /dev/null
+  allowBrowse             0
+}
+
 context /.well-known/acme-challenge {
   location                /usr/local/lsws/Example/html/.well-known/acme-challenge
   allowBrowse             1