ENH making /dev extendable

Just a little refactoring, no behavioural changes made. I made /dev extendable so more stuff can be added to the list there. Currently if you want to add something it requires editing the DevelopmentAdmin.php file in the framework, not very modular.

I chose to go with an array rather than e.g. finding all subtypes of a DevController class to keep this simple and foolproof, and to prevent manifest cache issues, it's not something that needs to be fancy and is unlikely to need a lot of flexibility.

I kept the list the same, not adding build/defaults or generatesecuretoken as they are hidden currently, a decision to display it in the /dev list can be made by someone else.

When testing make sure you test CLI as well, e.g. /example/framework/sake dev/build

Thanks!

I can't recall the exact attack off the top of my head but it looked like the below
`/dev/%3Cscript%3Ewindow.href%3Dwww.myattacksite.com%3C%2Fscript%3E`

If you don't set content/type as text/plan then your code would try to echo that into your page body, allowing the browser to interpret that as html (if it was stupid).

I know it's catering to dumb browsers, but we should always encode/block any output prior to sending it to the client.