Move forbidden api signature files to dev-tools.

This avoids the files showing up in the binary release, since .txt files are copied.

closes #7917