Switch to using friendly_id for product permalink generation

It's better for other people (who know better) to maintain at least some of the permalink generation code than for us to do it.

Old permalinks will still function correctly.

Proposed fix for #4167 + others
Remove variants from permitted_product_attributes

Since Product don't use nested_attributes rails feature for variants
anyway. Plus add some more tweaks to make sure it's possible to pass
either a hash of variants or of option types when creating a product.
Find or create shipping_category on api/products#create

Users can send a shipping_category string on the product payload and
spree will find or create that shipping_category and associate that
category with the product. e.g.

    product: {
      ...
      shipping_category: "Free Shipping Items"
    }