Do not list `doNotList` badges in API.

Fixes #245 

While we were correctly omitting `doNotList` badges from `/v2/badges`, we neglected to do so for `/v2/program/:shortname`

@cmcavoy to review