API: Fields parameter

[ErisDS]

As mentioned in #5463, we want to add a new fields top-level parameter to API browse requests.

The fields parameter allows a user to specify exactly which fields from a model should be returned, to limit the size of the response.

It can be implemented by using the 'columns' property of the bookshelf fetch method, which hooks into the 'column' method of knex.

Any specified fields should be validated to ensure that they are valid attributes of the requested model. Note that this should include the url attribute of posts even though it is calculated, and not include the password attribute of users, as that is protected.

The response should be the standard format, but with only the fields that were requested.

Support for relations, where they exist (e.g. tags for posts, roles for users) would be a bonus, but I'm not sure whether bookshelf/knex supports this just now so it can be added later if it adds too much complexity. The main purpose of this feature, short term, is to provide for only returning titles/names/slugs for the autocomplete (#5343).

Note: I have started implementing this in #5518, and discovered that whenever you request an unknown column, the response returned is somewhat strange - the column name is surrounded in quotes. Specifying url for posts results in 2 fields being returned, the proper url attribute and one quoted like "url". I would suggest we need to upgrade both bookshelf & knex and if it still happens, raise this as a bug whilst also implementing a workaround in the toJSON method.