disallow wildcard pull

[robertluo]

Sometimes data would not be allowed to pull especially for remote pulling, like a map value in data, on current implementation, you could pull from

{:a {:b 3, :c :foo}} using only :a, and the whole map will be returned, which is not good if some of the values are internal, not intended to expose. The data owner might only want user to pull some specified keys (or forbidden some keys). For example, {:a [:b]} should be OK, but :a will not allowed. In this example, the query :a will return differently for using it directly and using it inside a join.