🔒️(backend) avoid serializing rooms's pin code when restricted

Prevent anonymous users waiting in the lobby, or attacker
to discover the room pin code, that would allow them to join a room.

src/backend/core/api/serializers.py

@@ -159,6 +159,8 @@ class RoomSerializer(serializers.ModelSerializer):
                 configuration=configuration,
                 is_admin_or_owner=is_admin_or_owner,
             )
+        else:
+            del output["pin_code"]
 
         output["is_administrable"] = is_admin_or_owner