Lint against imports of openedx_catalog internals in openedx-core #860

Description

Add an import-linter contract to openedx-core that only lets other apps import openedx_catalog's public modules (api, models_api, data, tests), matching the rule openedx-platform already enforces. That way an import of openedx_catalog's internals fails CI in openedx-core instead of surfacing later, when openedx-platform installs a new openedx-core release.

Context

• fix: match openedx-platform's SIMPLE_HISTORY_DATE_INDEX in test settings #853 fixed an import of openedx_catalog.models in CBE code. openedx-platform's import linter caught it during bump openedx-core 1.4.0 → 1.10.0 openedx-platform#39199, the PR bumping openedx-core's version there; openedx-core's own linter had no rule against it.
• @ormsbee asked for this contract in his review of fix: match openedx-platform's SIMPLE_HISTORY_DATE_INDEX in test settings #853 and agreed it should be a separate follow-up PR so the version bump wasn't held up.
• Only openedx_catalog is in scope. Other apps, such as openedx_tagging, have no models_api.py yet, so adding them would need a separate design decision.

Acceptance Criteria

• .importlinter has a contract that treats openedx_catalog as an isolated app: code outside openedx_catalog may import only its api, models_api, data, and tests modules.
• lint-imports passes on main with the new contract. Today the only import of openedx_catalog from another app is from openedx_catalog.models_api import CourseRun in criteria.py, which is allowed.
• The PR description shows that the contract catches a real violation: temporarily changing that criteria.py line back to from openedx_catalog.models import CourseRun makes lint-imports fail and name that line.
• openedx_tagging and the other apps are not added to the contract.