Loopholes in new law mean credit bureaus will still be able to sell applicants’ information to their current lender, servicer or bank — a boon for lenders who also service their own loans.