REST API: Remove ".php" postfix.

Other endpoints like update or activate expect the plugin id without
the “.php” postfix.
REST API: Add settings to control API capability.

Add a field into the json-api module settings page that block the
access to actions like Update or Activate plugins via the API.