Update `ActionController::Parameters` to be more secure on parameters handling

This is the follow-up from #14384

---

I've fixed the code according to the recommendation, which is to go smarter while not breaking much compatibility.

So, these are the proposed changes:

* Calling `#to_h` on `AC::Parameters` will strip out unpermitted key. What this means is that if you call `#to_h` on `AC::Parameters` that's not permitted you'll get an empty hash. If the user wants to get the hash with all the keys, they're advised to duplicate the hash and call `#permit!` on it.
* `AC::Parameters` now have more accessor and mutator methods defined on it. These methods are methods that the resulting object didn't have correct permitted status on it.

I've adding a relevant changelog, and also mentioning that we'll move away from inheriting `AC::Params` from Hash on the next major release.

/cc @jeremy, @tenderlove
This case is simpler, since they're toplevel params. `:baz` would be `nil`.

The nested case is:
```ruby
p = params.permit(foo: :bar)
p[:foo][:baz] = params[:unpermitted]
p.to_h
# => { foo: { bar: 1 }}, or
# => { foo: { bar: 1, baz: unpermitted }} ?
```