restricted: check if public records if we want to restrict community

[kpsherva]

Steps to reproduce

1. Community was public
2. Submit a new public record to community
3. Change community to restricted
4. Accept the record into the community.

Expected outcome

We should not be able to publish a public record in restricted community in any possible way (should implement a validation on the moment of inclusion)

To be discussed: should we also disallow restricting the community once there is any public record already attached to this community?
Answer by Nico: this has been already taken into account here

Fix to apply

This check has been implemented for community-inclusion, but not for the first submission to a community. A similar check should be implemented here.