Update and fix readme section on strong parameters

We were missing the splat for expanding the array: `*policy(post).permitted_attributes`.