fix(rest/nodejs): stop copying client supplied omit members into the checkout response

[vishkaty]

What

The create handler builds the response by spreading the request body over the explicit keys. checkout.json marks continue_url, expires_at, messages and order as ucp_request omit, and none of the four has an explicit key, so a request carrying one sees its value come back in the 201 and persist into the stored session:

POST /checkout-sessions
{"line_items": [{"item": {"id": "bouquet_roses"}, "quantity": 1}],
 "continue_url": "https://platform.example/client-chosen",
 "expires_at": "2030-01-01T00:00:00Z"}

HTTP 201
response.continue_url = "https://platform.example/client-chosen"
response.expires_at   = "2030-01-01T00:00:00Z"

and a later GET returns the same values. messages behaves the same way, and so does order: a request carrying a fabricated order object, id and permalink included, sees it come back in the 201 and persist. ucp, id, status, totals, links and currency are unaffected because explicit keys already overwrite them, which is the negative control.

Fix

The destructuring that already drops fulfillment before the spread now also drops continue_url, expires_at, messages and order, so every ucp_request omit member gets the same treatment the explicit keys give the rest.

Testing

• New test/omit_fields.test.ts: a create carrying all four members must not adopt any of them, in the response or in the stored session read back by GET, and a create without them is unaffected. The adoption test fails on main and passes with the fix; suite 154 passing.
• Same defect class as currency (fix(rest/python): determine currency server side instead of reading it from the create request #156) and id (fix(rest/python): assign checkout id server side instead of trusting the request #167) on the Python server, and the mirror of samples#190 filed against the Python lane; this closes the class on the Node lane.