[core] Move object filtering to a mongoose toJSON transform, to easily handle subdocuments and also hide internals in the objects logged in events. Thus also change _id to id when creating users.