Shifted possible attack type finding into BMAttack

This pull request is especially to prepare for the addition of new attack types. Attack finding has now been moved to BMAttack.

The idea is to use either BMAttack::valid_attack_types() to offer the user attack types, which then allows us to streamline responder.php->submitTurn() to contain only calls to validate the user-specified attack.

I am unsure whether or not BMAttack::possible_attack_types() will be needed, or whether I should change it to being a protected static function.