Avoid common hackers alias calls to reach the database

[hugotiburtino]

Everybody that has a webapp knows that some bots are out there try to get secrets through some paths, like /.env or wp/admin....

Of course, we are not that dumm and are protected from these attacks. But it reaches oft through our alias query the database, making so unnecessary calls to it. We could simply block such requests, that we know we won't never have as alias.

See serlo/api.serlo.org#1573 (comment)