List the commitment fields participants can see, not the ones they can't #447

Follow-up to #395.

#395 stops participant responses (sign up, view, edit, move) from returning editTokenHash and idempotencyKeyHash. It does this by removing those two fields by name (withoutServerOnlyHashes in src/lib/public-commitment.ts).

The catch: if a new server-only column is added to commitments later, it will go out in participant responses unless someone remembers to add it to that list.

Suggested fix: build participant responses from a list of the fields they're allowed to see, for example by selecting only those columns. A new column then stays private until someone decides to share it. The two hashes would only be read where they're checked (the edit-link check and sign-up retries).

Done when: participant responses come from an explicit list of fields, and a test fails if a response includes anything not on that list.