API Marked statics private, use Config API instead (#8317)

WORK IN PROGRESS

Relies on https://github.com/silverstripe/silverstripe-cms/pull/305 and https://github.com/silverstripe/silverstripe-installer/pull/31

I think this should go into 3.1 rather than master because previous commits to 3.1 made configuration behaviour very inconsistent. Some configuration can stay static, arbitrarily determined by which internal core method has switched to the Config API yet. Hamish noted that we can make this clearer by a `@config` marker, but I still think that's a bit half assed. Its going to make the migration from beta2 to beta3 a bit more painful, but less so than hunting through core code for each static devs used. At least you get proper "can't access var" errors with my change ;)

 * Haven't changed `Security::setDefaultAdmin()` since its very security sensitive if people don't secure their YAML files properly. What do you think? Add an additional `.htaccess` in `mysite/_config/config.yml`?
 * Have a look if the upgrade nodes are comprehensible
 * Haven't used `Config::nest()` for tests yet, it causes all kinds of trouble
 * A few statics have been renamed, e.g Director::setBaseURL() to Director.alternate_base_url.
 * Remvoed `SecurityAdmin::$hidden_permissions` since it was a duplicate of the same fields in `Permission`
 * Removed two or three statics that weren't used anywhere in core