restrict cost_price to admin users through the api

I imagine stores don't wish to share their cost price openly. This change limits cost price value to admin users through the api.
This becomes even more important if you configure the application to allow open access to the api, as it used to be in 2.0 and earlier. 
I think we should do our best to drop this kind of logic from views (just saw we have it in other place too but still) we could append the protected attributes to `variant_attributes` on the controller instead? also wonder if this wouldn't bring issues with caching ..