SECURITY: Update reviewable user serializer payload

Exclude email from reviewable user serializer based on user scope.

app/serializers/reviewable_user_serializer.rb

@@ -16,4 +16,14 @@ class ReviewableUserSerializer < ReviewableSerializer
   def include_user_fields?
     object.target.present? && object.target.user_fields.present?
   end
+
+  def attributes(*args)
+    data = super
+    data[:payload]&.delete("email") if !include_email?
+    data
+  end
+
+  def include_email?
+    scope.can_check_emails?(scope.user)
+  end
 end