fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read

fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read #33815