How to select fields returned by GeoServer WMS GetFeatureInfo request?

Doesn't look good (source):

... GetFeatureInfo [...] is a WMS request and WFS. [...] One difference in their behaviour is that Geoserver sends always all the attributes with GetFeatureInfo but with WFS the list of attributes can be given in the request.

You could create a view that contains only the attributes your user wants to/should see and serve that through Geoserver.

An alternative would be to adjust die GetFeatureInfo template.

Just don't include the fields you don't want in your freemarker template. See http://docs.geoserver.org/trunk/en/user/tutorials/GetFeatureInfo/index.html#custom-templates

You can do this using the GeoServer propertyName WMS request parameter:

http://docs.geoserver.org/stable/en/user/services/wms/vendor.html#propertyname