Use permitted params instead of safe attributes in work packages bulk controller...


... to allow for cost_object_id updates (fixes #2591)