api: refactor api attribute declarations.

Replace the `method_attributes` and `hidden_attributes` methods with
`api_attributes`. `api_attributes` can be used as a class macro:

    # include only the given attributes.
    api_attributes :id, :created_at, :creator_name, ...

    # include all default attributes plus the `creator_name` method.
    api_attributes including: [:creator_name]

or as an instance method:

    def api_attributes
       [:id, :created_at, :creator_name, ...]
    end

By default, all attributes are included except for IP addresses and
tsvector columns.

test/functional/posts_controller_test.rb

@@ -217,6 +217,19 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
           assert_response :success
         end
       end
+
+      context "in api responses" do
+        should "not include restricted attributes" do
+          as(@user) { @post.update(tag_string: "loli") }
+          get_auth post_path(@post), @user, as: :json
+
+          assert_response :success
+          assert_nil(response.parsed_body["md5"])
+          assert_nil(response.parsed_body["file_url"])
+          assert_nil(response.parsed_body["fav_string"])
+          assert_equal(@post.uploader_name, response.parsed_body["uploader_name"])
+        end
+      end
     end
 
     context "update action" do