[SECURITY] Eloquent: use Model::setAttribute method instead of $this->$key

If you validate your models' attributes in per model method like `User::setUsernameAttribute()`, the validation won't even be done when the `Model::fill()` is called. This could lead to wrongly formatted data being inserted in your DB just fine if you haven't implemented domain checks on your database server.