Added a `fields` param to all API endpoints

The API now allows a new `fields` parameter that can filter returned
fields per document.

The fields need to be comma separated, without any spaces.

- Correct: `fields=id,url,packageName`
- Wrong: `fields=id&fields=url`
- Wrong: `fields=id, url`

Nested entities can be shown or hidden, but their fields cannot be
filtered.