Remove password hashes from legacy user API responses

[r1kka6]

Summary

• remove the password field from legacy v1 user serialization
• keep v1 and v2 user responses aligned so changing API versions no longer exposes password hashes

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/api/src/User.php
• vulnerable baseline returns password hashes from /vulnerabilities/api/v1/user/
• patched runtime returns only id, name, and level from both v1 and v2 user endpoints