Replace attr_accessible calls with strong params

When the GDS SSO gem calls attr_accessible with a role of :oauth it
creates an empty whitelist for the default role, so nothing can be set
with mass assignment. The AttrAccessibleNoop module stops the
attr_accessible call doing anything to prevent this issue.
Remove unnecessary attr_accessible calls

A hash of user input is never used to create or update these models so
attribute protected is unnecessary.
Remove attr_accessible from TopicSuggestion

In order to convert this to strong parameters we'd need to filter the
parameters for the whole edition form, which whilst worth doing, isn't
something we want to tackle as part of this work.
Fix mutation of arrays in params

ActionController::Parameters seems to return a copy of the contained
array rather than the original so you can't mutate it using #reject! and
friends.

Update code that mutates arrays in params to set the value explicitly
instead of relying on shared objects.