Relate restricted runs to CatalogQuery objects (ENT-9405)

[pwnage101]

Two main parts of this:

1. Pre-fetch restricted runs from discovery as needed. This is required because they might not yet be imported into the database at the time we are processing a CatalogQuery which allows them, but we need them imported at that point in time so that we can relate them to the CatalogQuery.
2. Actually create a new M2M relationship between ContentMetadata and CatalogQuery, and relate restricted runs to queries as defined in the content filter (original goal of this ticket).

ENT-9405