Update `ActionController::Parameters` to be more secure on parameters handling

This is the follow-up from #14384

---

I've fixed the code according to the recommendation, which is to go smarter while not breaking much compatibility.

So, these are the proposed changes:

* Calling `#to_h` on `AC::Parameters` will strip out unpermitted key. What this means is that if you call `#to_h` on `AC::Parameters` that's not permitted you'll get an empty hash. If the user wants to get the hash with all the keys, they're advised to duplicate the hash and call `#permit!` on it.
* `AC::Parameters` now have more accessor and mutator methods defined on it. These methods are methods that the resulting object didn't have correct permitted status on it.

I've adding a relevant changelog, and also mentioning that we'll move away from inheriting `AC::Params` from Hash on the next major release.

/cc @jeremy, @tenderlove
I was thinking cases like
```ruby
permitted = params.permit(:foo, :bar)

# later...
permitted[:baz] = params[:baz]

# then
permitted.to_h

# is permitted[:baz] == params[:baz], or {} now?