Improve validation of `products` list

#890 includes `cl-basic.*` and `cl-plus.*` products, but the system should only allow `cl.*` products. Since `cl-basic.*` has been around since the migration from OCLC it should be grandfathered in. There are probably some other to grandfather, but validation should prevent more top-level entries like these from being added. (I thought it already did, but apparently not.)