Fix issue where payments can get their credit cards disassociated from them.

This was initially discovered when integrating with the paper_trail gem, which
calls dup in an after_update to try to capture the changed state of the
object, however, this could happen elsewhere and it is good to be
defensive here.

Fixes #4512
Pass source attributes to force validation on spec