Tuleap nginx configuration uses $request_uri instead of $uri in various places notably to enforce the resource isolation based on the Sec-Fetch-* headers.

While our current config does not seem to allow a bypass of the existing rules due to the way the backed we should avoid relying on something that could surprise us.

Issue identified during an AI assisted audit (Opus 5.0).
Internal reference: CLAUDE-SECURITY-20260727-115759.