chore(developer): disable upload for server except localhost

Fixes #6299.

Moved some of the init to test.js from packages.js. If not on localhost,
then the UI for upload is disabled -- note that backend for upload is
already disabled for non-localhost.

This is necessary to prevent non-local site users uploading arbitrary
files to the cache, which could lead to security bypass.