Fix leaking private configuration parameters in Mastodon and Twitter APIs, and add new configuration parameters to Mastodon API

This patch:
- Fixes `rights` in twitterapi ignoring `show_role`
- Fixes exposing default scope of the user to anyone in Mastodon API
- Extends Mastodon API to be able to show and set `no_rich_text`, `default_scope`, `hide_follows`, `hide_followers`, `hide_favorites` (requested by the FE in #674)

Sorry in advance for 500 line one commit diff, I should have split it up to separate MRs

Closes: pleroma/pleroma#557

These attributes are documented as required by the Mastodon API.
Since we don’t support them (I think?), respond with default values.

Also use the correct field in TwitterAPI...

This removes the placehold.it dependency.

Handles users and mentions.