Extend the role binding api endpoint to include parameter fields and filtering described as in the specification for the endpoint

Which will require the creation of the service layer for the API

Acceptance Criteria

  Input Serializer

  - resource_id and resource_type required → 400 if missing
  - NUL bytes stripped from all query params
  - fields param parsed into FieldSelection object
  - Invalid fields → 400 with descriptive error

  Field Validation

  - Valid subject fields: id, type, group.name, group.description, group.user_count
  - Valid role fields: id, name
  - Valid resource fields: id, name, type
  - Valid root fields: last_modified
  - Unknown object type (e.g., foo(field)) → 400 error

  Output Serializer

  - Response structure unchanged from previous behavior
  - Field selection filtering still works correctly

  Regression

  - Existing /by-subject/ endpoint tests pass
  - No breaking changes to API response format