Move forbidden api signature files to dev-tools.

This avoids the files showing up in the binary release, since .txt files
are copied.

closes #7917
closes #7921