Prevent public access to user.ini

[rhoekman]

The “.user.ini” file that Wordfence creates can contain sensitive information, and public access to it should be restricted.

https://www.wordfence.com/help/firewall/optimizing-the-firewall/#hide-userini-nginx