Avoid npm WAF trigger in static middleware README (#11718)