Test that we don't expose content IDs to the site.

The content ID is designed to be visible only to the publishing tools
and the content store itself, not to the site-facing (and eventually
public-facing) side of the content store.

Thankfully, we restrict the presentation of content items with the
`PUBLIC_ATTRIBUTES` attribute anyway, so this doesn't get presented by
default.