Installation class cannot be accessible only with master key

Issue Description

From the client SDKs it seems that the Installation class is intended to be fully accessible to the user and cannot be made accessible only with the master key.

For example in Android SDK the ParseInstallation.getCurrentInstallation() does not expose all the fields it sends to the server when calling save() such as timeZone. This means that it is not easily possible to set the Installation to be accessible with master key only and use a cloud code function to create / update the Installation object. So a user can read and manipulate their Installation object.

Steps to reproduce

...

Expected Results

It should be possible to make the Installation class only accessible with master key.

Suggested Solution

It should be possible to use a cloud code function to create / update the fields of an Installation object.

Actual Outcome

There seems to be no way to not expose all fields of the Installation object to the user.

Environment Setup

• Server
  • parse-server version (Be specific! Don't say 'latest'.) : 3.x
  • parse-client android SDK version: 1.20.0

Logs/Trace

...

Start with the Android SDK entry point ParseInstallation.getCurrentInstallation() and the Installation fields sent during save(), then trace the corresponding Parse Server access-control and Cloud Code paths. Done means an Installation class can be restricted to master-key access while Cloud Code can create or update the fields required by the client SDK.