fix(MVC): discard excluded filters from query

[dpgaspar]

Description

Fixes a bug when a ModelView has declared search_columns and search_exclude_columns was still possible to filter by these fields when calling explicitly the URL with the filter format on the query parameters.

cc: @thesuperzapper @z-arosio

ADDITIONAL INFORMATION

• Has associated issue:
• Is CRUD MVC related.
• Is Auth, RBAC security related.
• Changes the security db schema.
• Introduces new feature
• Removes existing feature

[codecov]

Codecov Report

Merging #1862 (ca8a6e2) into master (f6f66fc) will increase coverage by 0.55%.
The diff coverage is 86.87%.

@@            Coverage Diff             @@
##           master    #1862      +/-   ##
==========================================
+ Coverage   77.08%   77.64%   +0.55%     
==========================================
  Files          56       70      +14     
  Lines        8226     8556     +330     
==========================================
+ Hits         6341     6643     +302     
- Misses       1885     1913      +28     

Flag	Coverage Δ
python	77.64% <86.87%> (+0.55%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
flask_appbuilder/security/manager.py	75.13% <28.57%> (-0.49%)	⬇️
flask_appbuilder/base.py	78.05% <68.13%> (-5.81%)	⬇️
flask_appbuilder/baseviews.py	89.46% <76.47%> (-0.46%)	⬇️
flask_appbuilder/utils/base.py	86.36% <76.47%> (-6.97%)	⬇️
flask_appbuilder/security/sqla/apis/user/api.py	93.02% <93.02%> (ø)
flask_appbuilder/security/sqla/apis/role/api.py	96.42% <96.42%> (ø)
flask_appbuilder/__init__.py	100.00% <100.00%> (ø)
flask_appbuilder/api/__init__.py	96.40% <100.00%> (+<0.01%)	⬆️
flask_appbuilder/models/mixins.py	73.33% <100.00%> (ø)
flask_appbuilder/security/sqla/apis/__init__.py	100.00% <100.00%> (ø)
... and 17 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 357c810...ca8a6e2. Read the comment docs.