userInfo endpoint should return all user attributes

[knstvk]

Using metadata or reflection.
Invent a way to hide the password field from API.

[gorbunkov]

The response should look like this:

{
   "username": "admin",
   "locale", "en_US",
   "attributes": {
       "username: "admin",
       "firstName: "admin",
       "lastName: "adminov",
   }
}

username and locale at the root level and user attributes in the "attributes" field.

Also, we should introduce the @Secret annotation in jmix-core. User attributes marked with this annotation (e.g. password) should not be returned by the endpoint.