Fix how file_ and password_field_tag edit options

This commit fixes the behavior of `file_field_tag` and `password_field_tag`
when invoked with a hash of options.

These two helpers are different from all the other ones in that they modify the
options hash passed as a parameter, whereas all the other helpers duplicate it
before updating it.

The result is that *bad things* can happen if the user re-uses the same hash.
For instance, users who write the following code to display a file field
followed by a text field (both with the same class):

```rhtml
<% options = {class: 'important'} %>
<%= file_field_tag 'Upload', options %>
<%= text_field_tag 'Name', options %>
```

would instead see **two file fields!**

```html
<input class="important" id="Upload" name="Upload" type="file">
<input class="important" id="Name" name="Name" type="file" value="value">
```

This PR replaces `update` with `merge` in the code of the two helpers,
fixing the issue above.

The included test verifies the change, since it passes after this PR, but
fails before with the following error:

```
Expected: <input type="text" name="title" id="title" value="Hello!" class="important" />
Actual: <input type="password" name="title" id="title" value="Hello!" class="important" />
```