Bug 1059871 api whitelist to leverage its lists from super search fields

@AdrianGaudebert r?

Even though it seems tests are working and manually testing it seems to work too. However, it feels like it was too easy. :)

Things to note:
* To keep things small, I did not try to solve it for Super Search's API exposure in this round. That's why the commit message doesn't say "fixed bug 1059871"
* I'm not in love about the `Lazy` class and the `materialize()` method. It does so little. Perhaps it can become something else instead. I looked at the `SimpleLazyObject` which looks good but that's more for doing things like attributes. 
* I'm really not in love making the `API_WHITELIST` be a combination of stuff from Super Search and an existing list. Ideally, we should type ALL of those in on the admin pages and just have one monster list. What do you think?

You need to check ``is_returned`` but not ``is_exposed``. ``is_returned`` controls whether or not the field is put into the results of the middleware service. ``is_exposed`` controls whether or not the field is filterable from the Super Search page.