fix: harden WordPress against WPScan findings

nginx/proxy-routes.conf

@@ -18,6 +18,26 @@ location = /xmlrpc.php {
     return 403;
 }
 
+location = /wp-cron.php {
+    return 403;
+}
+
+location = /readme.html {
+    return 404;
+}
+
+location = /license.txt {
+    return 404;
+}
+
+location = /wp-admin/install.php {
+    return 404;
+}
+
+location ^~ /wp-content/mu-plugins/ {
+    return 404;
+}
+
 location = /wp-login.php {
     limit_req zone=login burst=5 nodelay;
     proxy_pass http://wordpress_backend;