Update `ActionController::Parameters` to be more secure on parameters handling

This is the follow-up from #14384

---

I've fixed the code according to the recommendation, which is to go smarter while not breaking much compatibility.

So, these are the proposed changes:

* Calling `#to_h` on `AC::Parameters` will strip out unpermitted key. What this means is that if you call `#to_h` on `AC::Parameters` that's not permitted you'll get an empty hash. If the user wants to get the hash with all the keys, they're advised to duplicate the hash and call `#permit!` on it.
* `AC::Parameters` now have more accessor and mutator methods defined on it. These methods are methods that the resulting object didn't have correct permitted status on it.

I've adding a relevant changelog, and also mentioning that we'll move away from inheriting `AC::Params` from Hash on the next major release.

/cc @jeremy, @tenderlove
@jeremy In the first case you'll get `permitted[:baz] == params[:baz]` since you already mark the parameters as _permitted_. Mutating it does not change its `permitted?` status.

For the second case, you'll also get `{ foo: { bar: 1, baz: unpermitted }}` because of the same reason.

Note that this is the behavior because we're not actually saving the permission setting of the parameters hash. We perform a dup, slice, mark it as safe, and call it done.

If you think that's unacceptable, then maybe we have to store the list of permitted parameters, and then perform a slice again upon converting to Hash, or when it's being mutated. Wdyt?