theia: make /public/ really public, but prevent JS execution

2 jobs for 1.0
Status Job ID Name Coverage
  External
failed ERP5.StandaloneDeploymentScriptTest-Debian.Buster.Master

failed Wendelin.StandaloneDeploymentScriptTest-Debian.Buster.Master