Limit the API data send to JS

[oharsta]

Currently in most of the API calls, the SQLAlchemy objects are returned as is in json-format. This causes sensitive data to leak to the client. The solution can be simple as we already have hooks to filter and / or sanitise data in the DynamicExtendedJSONProvider and SecretMixin.

Already filtered out by the current SecretMixin and DynamicExtendedJSONProvider implementation are the following attributes

SecretMixin: ["ldap_password", "hashed_token", "hashed_secret", "scim_bearer_token", "oidc_client_secret"]
DynamicExtendedJSONProvider: ["mfa_reset_token", "second_factor_auth"]

We can extend the current implementation to check if there is a session in the current flask request and depending on the role of user and the type of object we can further limit the data send back to the JS client.

We need to identify the sensitive attributes that do not have to leave the server and are not covered by current sanitisation.