fix: [security] fields not adhered to in CRUD components edit

- users can circumvent restrictions on editable fields
- can lead to privilege escalation when users edit themselves

src/Controller/Component/CRUDComponent.php

@@ -307,6 +307,9 @@ class CRUDComponent extends Component
                 'associated' => []
             ];
             $input = $this->__massageInput($params);
+            if (!empty($params['fields'])) {
+                $patchEntityParams['fields'] = $params['fields'];
+            }
             $data = $this->Table->patchEntity($data, $input, $patchEntityParams);
             if (isset($params['beforeSave'])) {
                 $data = $params['beforeSave']($data);