Authenticated custom-field disclosure via wholesale group serialization

Information disclosure in Discourse Group Membership IP Blocks allows remote authenticated users to read group custom fields. The plugin's BasicGroupSerializer returns object.custom_fields wholesale instead of selecting its own ip_blocks_list field, exposing fields registered by other plugins. A low-privilege account can retrieve affected group responses over the network; the consequence is limited to confidentiality and requires another plugin to store sensitive values there.