Always compact array parameters rather than setting them to nil

Rebase reapplication of #9569, thanks to @collectiveidea and @laserlemon

The CVE-2013-0155 security vulnerability outlines how array parameters
containing nil values can be dangerous when accepted directly into
Active Record finder methods. The previous fix has been to detect array
parameters with nil values and to clobber the entire array into nil.

Instead, compacting the array solves the security issue and causes less
surprise in the case where array parameters are expected, as is often
the case when accepting nested attributes for collections.