RBAC enhancements: don't fetch column if not allowed to fetch column

[benjie]

Since we know what role the request is running as and we know which roles can access each column, we should replace all fetches for ungranted columns with null. This would avoid RBAC errors if you try and request things you're not allowed to (though it may result in non-null blowups).

Maybe this should be achieved via an additional preset, and that preset would make all columns like this nullable?