includes and excludes report as object instead of array of strings in the openapi schema

[mdellweg]

Additionally in the database and the serializer these fields are represented by JSONField while they should be ArrayField of CharField. I believe that would also get the openapi docs right for free.