Fix issues with successive calls to .create() or .update() on resources.

The create and update methods had a parameter `data` which had a default value
of {}. In the body of these methods, we used `data.update(...)`, which would
write to that default value. This means that successive calls would include
data that wasn't intended.

This was hit when using 'rbt post -u CLN' to update a public review request
with a perforce repository. We'd update the review request resource with
'changenum', and then try to update the draft with 'public', but that would end
up also sending 'changenum' to the draft resource, which doesn't have that
attribute.

Testing done:
Reproduced the case in the bug. After this fix, I can use 'rbt post -u CLN' to
update and publish a review request all in one go.

Fixes bug 3197.

Reviewed at https://reviews.reviewboard.org/r/5269/