Bug 1059871 api whitelist to leverage its lists from super search fields

@AdrianGaudebert r?

Even though it seems tests are working and manually testing it seems to work too. However, it feels like it was too easy. :)

Things to note:
* To keep things small, I did not try to solve it for Super Search's API exposure in this round. That's why the commit message doesn't say "fixed bug 1059871"
* I'm not in love about the `Lazy` class and the `materialize()` method. It does so little. Perhaps it can become something else instead. I looked at the `SimpleLazyObject` which looks good but that's more for doing things like attributes. 
* I'm really not in love making the `API_WHITELIST` be a combination of stuff from Super Search and an existing list. Ideally, we should type ALL of those in on the admin pages and just have one monster list. What do you think?

I think I understand what this is warning me about, but I had to read it a few times first.  Perhaps there is a different way to phrase this warning, something like:
> Warning! By default, newly added `raw_crash` or `processed_crash` items will be exposed via the public API. To make them private, set permissions as appropriate via the admin interface.

Does that make sense?