added serialized_object for chef_user
capture all relevant fields for chef_user and do not return ones caller should not see

* capture serialized_object, external-authentication-uid and recovery-authentication-enabled
* when assembling ejson reply with all expected values per EC, not reduced list of OSC
* when assembling ejson reply exclude any fields not whitelisted.
* when preparing for update, properly merge inbound data with existing
  data in seraliazed_object