config: disable variable expansion in project-level configs (security)