Update `ActionController::Parameters` to be more secure on parameters handling

This is the follow-up from #14384

---

I've fixed the code according to the recommendation, which is to go smarter while not breaking much compatibility.

So, these are the proposed changes:

* Calling `#to_h` on `AC::Parameters` will strip out unpermitted key. What this means is that if you call `#to_h` on `AC::Parameters` that's not permitted you'll get an empty hash. If the user wants to get the hash with all the keys, they're advised to duplicate the hash and call `#permit!` on it.
* `AC::Parameters` now have more accessor and mutator methods defined on it. These methods are methods that the resulting object didn't have correct permitted status on it.

I've adding a relevant changelog, and also mentioning that we'll move away from inheriting `AC::Params` from Hash on the next major release.

/cc @jeremy, @tenderlove
Actually, I don't think we need to worry about that as I believe even `always_permitted_parameters` only process the key on the 1st level. When they call `#permit`, we does a recursion to remove those unpermitted key from a duplicate object and mark the `Parameters` as permitted.