Making the regex that gets the index courses more secure

[OmarIthawi]

So https://red.staging-tahoe.appsembler.com/api/courses/v1/courses/ won't show up redislabs courses.

It used to match redislabs orgs as if it was red. https://github.com/edx/edx-platform/pull/21220 fixes that issues and this pull request cherry pick it.

[thraxil]

It looks more secure. I'm not sure if using a regex match in the SQL query is what we ought to be doing in general. It seems like the kind of thing that could lead to an injection or at least DoS issue someday.

If we're just finding courses that have an org that's in a list, it seems like some combination of __in and __iexact is more what we want. Something like what's discussed here: https://stackoverflow.com/questions/14907525/how-can-i-chain-djangos-in-and-iexact-queryset-field-lookups/14908214

We might also step back and ask why the courses just have the org as a string that we then match on rather than a proper model and foreign key construction.

[OmarIthawi]

You're right @thraxil, but that would be swimming against the upstream (https://github.com/edx/edx-platform/pull/21220):

I don't think we can afford it for this bit.

[OmarIthawi]

Thanks for the original suggestion @thraxil I've made an upstream pull request to refactor it:

• https://github.com/edx/edx-platform/pull/22631