Fix the `permit` matcher to be less intrusive

This is a fix for #482.

----

Within the `permit` matcher, we need to keep track of when #permit was
called and which arguments it was called with. Previously we did this by
overriding ActionController::Parameters#[] to return an instance of
StubbedParameters (which, when #permit was called on it, would then
track the call).

This has three problems:

* We're overriding something in a global class. We can simply override
  something on the controller that's being tested instead.
* Overriding #[] is kind of magical. How does this even end up doing
  what we want? Really we should just replace the entire params hash.
* Controller tests involve hitting actions on real controllers. Those
  actions may need to access the params hash. Completely changing how
  the params hash works prevents them from being able to do that.

To solve this, we override the params hash on the controller under test
with an instance of StubbedParameters, which decorates the original
params hash. We then override #permit to track the call, but then we let
it do its thing.