Clarify modification of req.params

This clarifies the usage of req.params, including an anti-pattern example that will cause unexpected behavior.
This applies more to `req.params` than `app.param()`, not sure this belongs in this section.

IMO it is sufficient to mention in the `req.params` section that the object is read only.