[Koha-bugs] [Bug 35228] REST API: Restricted staff users can see patron extended attributes (not exposed via UI)