Declare files which should not be packaged for production

This is related to #2744463: Add phpcs, coder 8.2.8 as --dev requirements for drupal/core. If we are going to include Coder with Drupal core, we should make sure that our test files are not included when a core release is packaged. Our tests do some real funky stuff and might cause security problems.

This of course benefits any project that would like to package Coder, not just core.