Capability checks for some user profile fields are not consistent between LMS and WebServices

I noticed this when I wanted to apply MDL-72458 in the app.

AFAIK in Moodle LMS (browser) the only check to decide if the timezone should be displayed or not is whether it's a hidden field. However, in the WebServices core_user_get_course_user_profiles and core_user_get_users_by_field the capability moodle/user:viewalldetails is checked (and I think hidden fields isn't checked for timezone).

This means that, for example, in browser as a student I can see another user's timezone but in the app as a teacher I can't. These checks should be more consistent to be able to have a consistent experience between LMS and the app.