Fix for #877 and #878

I've adjusted the whitelist logic in `Foxx.Model` to whitelist the metadata attributes by default. I have also added a `fromClient` static method that allows stripping the metadata when loading a model from an untrusted source and adjusted `forClient` so it also strips the metadata.

If any metadata attributes are defined on the constructor, they will be processed as normal.

I've also made sure `Model` and `Model.fromClient` *always* set the `attributes` property to a fresh object to avoid the bug in #878.

The tests in `shell-foxx-model.js` have been adjusted accordingly.

This change introduces behaviour that may be break code relying on `forDB` not returning metadata attributes passed to the constructor when the model has attributes defined that do not include the metadata attributes. This seems like an edge case.