Make nested attributes act as create_or_update

After some more exploration into #10344, I felt that I understood how things were set up a bit better, and this seemed the best solution (of course, let me know if you see a better one :wink:).

Since `:without_protection` has been removed from ActiveRecord in an effort to move security away from the model, there is now no way to create nested objects while specifying the `id`/primary key.  Since strong_parameters works with nested attributes, it should still support this ability.

Also, since all other behavior with nested attributes generally works as `create_or_update`, we should follow that pattern here and allow creation of nested attributes, both when an ID is omitted and when it is present.  Currently, passing a hash which includes a (currently) non-existant `id` will throw a `RecordNotFound` error (this behavior was tested, but not documented anywhere).  Rather than adding a `:without_protection`-type parameter back in, this seemed like the best option because it was more or less what the documentation and API seemed to already be implying.

The clearest case where this is an issue is the case of UUID, where the primary key may be generated elsewhere and should be respected by the Rails service.

I would welcome any feedback or suggestions.

*Note: this pull request is closely related to #10271, and the merge may be slightly messy, but they seemed like separate issues, so I created a separate pull request.*