API Block all yaml files by default, to reduce the change of information leakage

This pull request - https://github.com/silverstripe/silverstripe-installer/pull/28 - raised against 3.0 instead (so it can be merged into 3.1 and master)