Bug 1059871 api whitelist to leverage its lists from super search fields

@AdrianGaudebert r?

Even though it seems tests are working and manually testing it seems to work too. However, it feels like it was too easy. :)

Things to note:
* To keep things small, I did not try to solve it for Super Search's API exposure in this round. That's why the commit message doesn't say "fixed bug 1059871"
* I'm not in love about the `Lazy` class and the `materialize()` method. It does so little. Perhaps it can become something else instead. I looked at the `SimpleLazyObject` which looks good but that's more for doing things like attributes. 
* I'm really not in love making the `API_WHITELIST` be a combination of stuff from Super Search and an existing list. Ideally, we should type ALL of those in on the admin pages and just have one monster list. What do you think?

Actually, I don't know if you want to check ``is_returned``. This value makes sense in the context of Super Search. Does it have the same meaning for the ``RawCrash`` and ``ProcessedCrash`` services? Maybe not. It's up to us, actually. What do you think? Should we just expose every known permission-less field?