[BUG] `exclude` query parameter doesn't work for nested fields

[calumbell]

Description

As of #872 users have been able to filter API fields using the ?excludes query parameter.

IE. /v2/creatures/srd_goblin/?exclude=actions returns the srd-2014 Goblin statblock, but with the actions field omitted. This is helpful for providing API users with a convenient way to streamline their queries.

One missing piece of functionality is the ability to exclude nested API fields. This feature is supported for the ?fields parameter (for white-listing fields) using the double-underscore operator. By way of an example lets start with something like:

/v2/creatures/srd_goblin/?fields=name,key,actions

Which will return something like:

{
    "key": "srd_goblin",
    "name": "Goblin",
    "actions": [
        {
            "name": "Scimitar",
            "desc": "Melee Weapon Attack: +4 to hit, reach 5 ft., one target. Hit: 5 (1d6 + 2) slashing damage.",
            "attacks": [
                {
                    "name": "Scimitar attack",
                    "attack_type": "WEAPON",
                    "to_hit_mod": 4,
                    "reach": 5,
                    "range": null,
                    "long_range": null,
                    "target_creature_only": false,
                    "damage_die_count": 1,
                    "damage_die_type": "D6",
                    "damage_bonus": null,
                    "damage_type": {
                        "name": "Thunder",
                        "key": "thunder"
                    },
                    "extra_damage_die_count": null,
                    "extra_damage_die_type": null,
                    "extra_damage_bonus": null,
                    "extra_damage_type": null,
                    "distance_unit": "feet"
                }
            ],
            "action_type": "ACTION",
            "order_in_statblock": 0,
            "legendary_action_cost": 1,
            "limited_to_form": null,
            "usage_limits": null
        },
        ...
    ]
}

Works as intended so far. API is only returning fields requested by the ?fields query parameter. But lets say that we want to omit certain fields returned by the actions field. While we do have a ?exclude query parameter, this does not currently work on nested fields.

Now, on the front-end none of the data in the attacks field of the actions object is used. It can be safely omitted and everything will still run as intended. Slightly faster in fact, the actions__attacks field bloats some statblocks enormously.

One solution is to use the ?attacks__fields query parameter to whitelist all the subfields of attacks except for attacks:

/v2/creatures/srd_goblin/?fields=name,key,actions&actions__fields=name,desc,action_type,order_in_statblock,legendary_action_cost,limited_to_form,usage_limits

Which gets you what you want: an actions field without the attacks subfield. But it is extremely verbose. Ideally we'd like to see the same results using the following query parameters:

/v2/creatures/srd_goblin/?fields=name,key,actions&actions__exclude=attacks

This will likely involve update the ExcludeFieldsMixin to recursively remove nested excludefields