Provide a consistent way of describing the difference between DB schema and request/response

[cebe]

moved from cebe#135

For simple CRUD operations the DB schema often matches the JSON schema of the request response exactly.
However there are a lot of use cases where the schema returned by the API is very different from the API.

Example:

User:
  type: object
  properties:
    id:
      type: integer
    username:
       type: string
       maxLength: 32
    password_hash:
       type: string
       maxLength: 64

For obvious reasons we do not want to expose the password_hash on the API.

Possible solutions:

use readOnly and writeOnly (related to https://github.com/cebe/yii2-openapi/issues/4)

use sepearate Schemas for DB and API and find a way to link them together