SECURITY: Create a .htaccess in /vendor after composer runs

SECURITY: Create a .htaccess in /vendor after composer runs

The /vendor directory does not need to be web accessible, and to reduce
attack surface, it should not be web accessible. We can use the
post-install-cmd and post-update-cmd hooks to create a .htaccess after
the user has run "composer install" or "composer update". On the first
run of composer, this hook will be invoked twice due to the composer
merge plugin.

If the htaccess file already exists, this hook won't do anything.

Bug: T180237
Change-Id: I2cf6541750c90b5708d7cf5f81b914ae2d9d46d1