Use permitted params instead of safe attributes in work packages bulk controller...


... to allow for cost_object_id updates (fixes #2591)
Fix work_packages/bulk#update if no work package params are passed
Perform individual parameter whitelisting during work package bulk update
Update changelog (add #2718)
Migrated serialized yaml in core tables from syck to psych
Added changelog entry