Confidential module settings (cleint_id, client_secret) exposed on Mediaflow forms

Problem/Motivation

User/editor can see the confidential module settings in browser console.

The module exposes the whole settings array including client_id and client_secret which are accessible by typing drupalSettings.mediaflow in the browsers console.

Steps to reproduce

Go to the Add media item page (/media/add/mediaflow), open browser console and type drupalSettings.mediaflow.

Proposed resolution

Don't expose confidential data, use server-side requests when needed.

Remaining tasks

User interface changes

API changes

Data model changes