feat: more restricted runs and contains_content_items logic

[iloveagent57]

* contains_content_items endpoint now both utilize the same shared logic around restricted runs
* contains_content_items top-level key returns true based on explicit content membership *or*
membership in configured restricted runs mapping
* The previous point implies that requests about restricted course runs
will response with contains_content_items=true, even if the run is
not tied directly to the catalog via ContentMetadata records.
ENT-9386

Post-review

• Squash commits into discrete sets of changes
• Ensure that once the changes have been deployed to stage, prod is manually deployed

[pwnage101]

The rest LGTM!

[adamstankiewicz]

LGTM, pending any test updates (happy to re-review once tests updated).

[adamstankiewicz]

[kudos] Nice cleanup of any_catalog_contains_content_items, and only relying on the empty vs. non-empty catalogs_that_contain_course.