Bug 1059871 api whitelist to leverage its lists from super search fields

@AdrianGaudebert r?

Even though it seems tests are working and manually testing it seems to work too. However, it feels like it was too easy. :)

Things to note:
* To keep things small, I did not try to solve it for Super Search's API exposure in this round. That's why the commit message doesn't say "fixed bug 1059871"
* I'm not in love about the `Lazy` class and the `materialize()` method. It does so little. Perhaps it can become something else instead. I looked at the `SimpleLazyObject` which looks good but that's more for doing things like attributes. 
* I'm really not in love making the `API_WHITELIST` be a combination of stuff from Super Search and an existing list. Ideally, we should type ALL of those in on the admin pages and just have one monster list. What do you think?

I think we just use it. The name is quite explicit and a human would maybe not expect it to suddenly appear in the API if the deliberately didn't not check the "is_returned" field. We can ponder it and maybe change in the future.