Add shipments_attributes to permitted_checkout_attributes

Spree API needs to receive a shipment id and shipping_rate_selected_id
during checkout
Fix api/orders_controller strong params

Apparently we need to make the `map_nested_attributes_keys` in
api/base_controller return a hash valid for strong parameters module.
Otherwise too much manual work will be done