[PSR-7] Clarify superglobal usage

Per [this thread](https://groups.google.com/d/msgid/php-fig/543C8821.7070602%40garfieldtech.com):

- Updated `getQueryParams()` to indicate that the value MAY come from `$_GET`, but may come from other sources, but MUST follow the same structure as `$_GET`.
- Updated `(get|set)CookieParams()` to indicate that the value MAY come from `$_COOKIE`, but may come from other sources, but MUST follow the same structure as `$_COOKIE`.
- Updated `getFileParams()` to indicate that the value MAY come from `$_FILES`, but may come from other sources, but MUST follow the same structure as `$_FILES`.

Per [this thread](https://groups.google.com/d/msgid/php-fig/543D4262.5010703%40garfieldtech.com):

- Updated `getQueryParams()` to indicate that if the value injected is from the URI, the same rules that PHP's `parse_str()` would use should be followed when dealing with duplicate query parameters and nested values.

Per [this thread](https://groups.google.com/d/msg/php-fig/jKOsGn_-vz8/qYyITzVsC1gJ):

- Updated `(get|set)BodyParams()` to ONLY use arrays, not objects. This means that you can only inject deserialized body parameters IF they can be coerced to an array. Note: you can get creative with this, and do something like `$request->setBodyParams([ 'payload' => $anObject ]);`. The point is having a consistent mechanism.
- Updated all methods in the `IncomingRequestInterface` to stipulate that arrays ONLY are accepted or returned; again, this is for consistency of implementation.
- Renamed `(get|set)PathParams()` to `(get|set)Attributes()`, per a suggestion from @simensen; the docblock was updated to indicate "attributes derived from the request."