Security: Static client resources are loaded from the root package, giving access to the entire backend jar

[rocketraman]

The static client resources are loaded from the root package, which gives clients access to the entire backend jar.

For example, run the server and then try to access:

http://localhost:8080/application.conf

or

http://localhost:8080/MainKt.class

Both of these work!

The copy task at https://github.com/Kotlin/full-stack-web-jetbrains-night-sample/blob/master/server/build.gradle.kts#L55-L57 should be modified to put the resources into a subdirectory e.g. web, and then ktor configured to serve static resources from the web package only.