Legacy Restriction Mapping - Ministry Changes

**User Story**
As a ministry user, I want to know about some restrictions imported from the legacy bridge but others are not going to be needed. Right now we directly map a few restrictions into unique restrictions in SIMS and the rest are mapped into a "LGCY" restriction to be reviewed by ministry users as required.
This is a continuation of #4013 and the goal is to prevent the Ministry user from adding a `LGCY_*` restriction to SIMS.

**Acceptance Criteria**
- [ ] Prevent a Ministry user from adding legacy restrictions (`is_legacy` as true) to the student.
- [ ] Ministry should be able to see and resolve a legacy restriction, adding a note, following the process that is already in place for any provincial restriction.

Read issue #4013 and trace the existing provincial restriction workflow for how restrictions are added, viewed, resolved, and annotated. Identify where the Ministry-user rule can prevent restrictions with `is_legacy` set to true from being added while preserving the existing view-and-resolve process; done means both acceptance criteria are covered.

Written by the indexing model from the issue text.