AO3-5713 fix tag set fandom only validation

[pmonfort]

Pull Request Checklist

• Have you read "How to write the perfect pull request"?
• Have you read the contributing guidelines?
• Have you added tests for any changed functionality?
• Have you added the Jira issue number as the first thing in your pull request title (e.g. AO3-1234 Fix thing)
• Do you have fewer than 5 pull requests already open? If not, please wait until they are reviewed and merged before creating new pull requests.

Issue

https://otwarchive.atlassian.net/browse/AO3-5713

Purpose

The "Tag set fandom only?" option (character_restrict_to_tag_set / relationship_restrict_to_tag_set) on challenge prompt restrictions only controls the autocomplete suggestions in the signup form, but does not actually validate on the server side. Users can bypass the autocomplete by typing a tag name manually and submit characters or relationships that are canonical in the fandom but not in the tag set.

This PR adds server-side validation in Prompt#restricted_tags so that when restrict_to_tag_set is enabled, allowed tags are further filtered to only those present in the tag set associations for the selected fandom. It reuses the tag_set_associations scope already set up by the AO3-5712 fix.

Testing Instructions

1. Create a gift exchange collection with a tag set that has a fandom and a few characters associated to that fandom.
2. In the challenge settings, enable both "Restrict characters to fandom?" and "Tag set fandom only?" for offers.
3. Sign up for the challenge. In the offer, select the fandom.
4. Try to manually type a character that is canonical in the fandom but not in the tag set.
5. Expected: The signup should fail validation with an error that the character is not in the selected fandom's tag set.
6. Now type a character that is in the tag set for that fandom.
7. Expected: The signup should be valid.
8. Disable "Tag set fandom only?" and repeat — characters canonical in the fandom but not in the tag set should now be accepted.

Credit

Pablo Monfort (he/him)