fix(ers): dont leak direct entitlements into additional props

[elizabethhealy]

Proposed Changes

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 75663b01-41b8-4376-849b-bd6016702c19

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.312131ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.490343ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	420.804759ms
Throughput	237.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.142866643s
Average Latency	420.607679ms
Throughput	118.64 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/ocrypto
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-3911-pull-3911
✅ go@main-pull-3911
✅ go@pull-3911-v0.9.0
✅ go@pull-3911-main
✅ go@main-main
✅ go@main-v0.9.0
cukes-report
✅ java@main-pull-3911
✅ java@main-main
✅ js@main-main
✅ js@main-v0.9.0
✅ js@main-pull-3911
✅ java@main-v0.9.0
opentdfplatformPRD0IO.dockerbuild
govulncheck-failure-0
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-2
govulncheck-failure-4