fix(2meet-data-optimizer): treat contact and address keys as private in the public REST filter

- rest_exposable() also withholds keys named like an email, phone, address or
  IP, even when a field declares show_in_rest (defence in depth)
- Verify: RestApiTest (private and look-alike public keys), unit 701,
  integration 577, phpcs, stan; dev36 live rest suite
- PR: PR-096

tests/unit/RestApiTest.php

@@ -164,6 +164,21 @@ class RestApiTest extends TestCase {
 		$this->assertSame( array( 'id', 'post_type', 'hp_price' ), array_keys( $data ) );
 	}
 
+	public function test_contact_and_address_keys_stay_private_even_when_declared_public(): void {
+		$private = array( 'hp_email', 'hp_contact_e_mail', 'hp_phone_number', 'hp_address', 'billing_address_1', 'hp_ip', 'hp_client_ip_addr' );
+		$public  = array( 'hp_price', 'hp_description', 'hp_tip_amount', 'hp_shipping_days' );
+		$fields  = array();
+		$values  = array();
+		foreach ( array_merge( $private, $public ) as $key ) {
+			$fields[]       = array( 'meta_key' => $key, 'zone' => 'cold', 'show_in_rest' => true );
+			$values[ $key ] = 'v';
+		}
+
+		$data = $this->listing_with( $fields, $values );
+
+		$this->assertSame( array_merge( array( 'id', 'post_type' ), $public ), array_keys( $data ) );
+	}
+
 	public function test_rest_visible_columns_exclude_protected_and_credential_keys(): void {
 		$registry = WPDO_Schema_Registry::instance();
 		$registry->register( 'test', array( 'post_type' => 'hp_listing', 'meta_key' => 'hp_price', 'zone' => 'hot', 'column' => 'hp_price', 'show_in_rest' => true ) );