Update `ActionController::Parameters` to be more secure on parameters handling

This is the follow-up from #14384

---

I've fixed the code according to the recommendation, which is to go smarter while not breaking much compatibility.

So, these are the proposed changes:

* Calling `#to_h` on `AC::Parameters` will strip out unpermitted key. What this means is that if you call `#to_h` on `AC::Parameters` that's not permitted you'll get an empty hash. If the user wants to get the hash with all the keys, they're advised to duplicate the hash and call `#permit!` on it.
* `AC::Parameters` now have more accessor and mutator methods defined on it. These methods are methods that the resulting object didn't have correct permitted status on it.

I've adding a relevant changelog, and also mentioning that we'll move away from inheriting `AC::Params` from Hash on the next major release.

/cc @jeremy, @tenderlove
In the second case, `params[:unpermitted]` wasn't permitted, though?

Ensuring we're thinking through the security of this, if we say `#to_h` is safe output but it has cases where unpermitted params may sneak through.