Add strong_parameters gem

Rails 4 ditches attr_accessible and attr_protected in favour of strong
parameters. This gem lets us use the strong parameters pattern with
Rails 3.2 to get everything working before we upgrade.
Replace attr_accessible calls with strong params

When the GDS SSO gem calls attr_accessible with a role of :oauth it
creates an empty whitelist for the default role, so nothing can be set
with mass assignment. The AttrAccessibleNoop module stops the
attr_accessible call doing anything to prevent this issue.
Remove unnecessary attr_accessible calls

A hash of user input is never used to create or update these models so
attribute protected is unnecessary.
Remove attr_accessible from TopicSuggestion

In order to convert this to strong parameters we'd need to filter the
parameters for the whole edition form, which whilst worth doing, isn't
something we want to tackle as part of this work.
Fix mutation of arrays in params

ActionController::Parameters seems to return a copy of the contained
array rather than the original so you can't mutate it using #reject! and
friends.

Update code that mutates arrays in params to set the value explicitly
instead of relying on shared objects.
Mix ForbiddenAttributesProtection into all models

Rails 4 will have this behaviour in all models so I'm mixing it in now
to get any issues fixed before we upgrade.
Raise on unpermitted paramters in dev and test mode

In the interest of failing fast and warning developers of errors, ask
action controller to raise if unpermitted paramters are submitted to a
controller (rather than silently stripping them out).

See:

https://github.com/rails/strong_parameters#handling-of-unpermitted-keys
Patch ActionController::Parameters#reverse_merge

Calling #reverse_merge on an ActionController::Parameters object builds
a new object which doesn't have the same value for the permitted
instance variable. This monkey patches #reverse_merge to set the value
of permitted to match the original, on the basis that if you're
reverse_merging into an already permitted hash you are probably happy
with the new keys
Add strong params for attachments
Add strong params for access and opening times
Add strong params for contacts and offices
Add strong params for corp info pages & translations
Strong params - Admin::FactCheckRequestsController
Add strong params for editions

A lot of edition tests used the controller_attributes_for_instance method
to build a hash from the attributes of an edition which they send to the
controller method. This means a lot of attributes that we don't actually
want to be updateable are included, which raises an error because of the
setting of config.action_controller.action_on_unpermitted_parameters.

This commit stops that method being used in tests and removes it.
Add strong params for roles & appointments
Add strong params for policy groups & teams
Add strong params for topics & topical events
Add strong params checks to Admin::OrganisationsController

and fix a few tests
Permitted params on Admin::FeaturesController
Permitted params on Admin::SocialMediaAccountsController