Fix/cdodge/update localdev setting for unsafe courses

Not sure I know why - maybe @cpennington or @ormsbee might have an idea - but the "COURSES_WITH_UNSAFE_CODE" was not getting into the localdev CMS settings (dev.py), even though cms.envs.common.py imports lms.envs.common.py.

So added an explicit setting in cms.common.py as well as adding a highly restrictive default value.

@nedbat @cahrens can you review?