There's a number of places where we create/have .htaccess files with "Deny from all", which was deprecated in Apache 2.4 (initially released in 2012). The replacement appears to be "Require all denied".
This was originally filed as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064797.