[green] Quarantine burned firmware candidate

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>
(cherry picked from commit 21ed1a9e8d477805a88c15a58866cfd2a1fe31b3)

Author: yyods

tools/web/deploy/nginx/10-pyble-dev-https.conf

@@ -75,6 +75,22 @@ server {
         try_files $uri =404;
     }
 
+    # v0.4.1 was a pending pre-public candidate exposed without the required
+    # access control. Keep its retained bytes outside public routing forever.
+    location ^~ /firmware/v0.4.1/ {
+        include /etc/nginx/snippets/pyble-security-headers.conf;
+        add_header Cache-Control "no-store" always;
+        error_page 404 = @burned_firmware_candidate;
+        return 404;
+    }
+
+    location @burned_firmware_candidate {
+        internal;
+        include /etc/nginx/snippets/pyble-security-headers.conf;
+        add_header Cache-Control "no-store" always;
+        return 404;
+    }
+
     location ^~ /firmware/ {
         include /etc/nginx/snippets/pyble-security-headers.conf;
         add_header Cache-Control $pyble_firmware_cache_control always;