Hide web_resources_devserver() internal flags

[dgp1130]

Currently, the only flag which web_resources_devserver() supports is --port, but anything you pass gets propagated through to the underlying http-server, meaning all it's flags are accessible. This leaks the abstraction and makes it harder to change the implementation over time.

web_resources_devserver() should explicitly ban any other arguments to make this a stronger abstraction.