request: strong params checks for id (key) columns

The problem:

Junior developer does not quite understand that params.permit(:id, :name) means that the user can now change the name of any row - not just the one[s] they have access to.

Likewise params.permit(..., :parent_id) means you get to assign some row to any parent.

But params.permit(:name, children_attributes: [:id, :name]) is fine because the children will get scoped to the parent.

And of course params.permit(:name, children_attributes: [:id, :name, :parent_id]) is not OK unless you intend to allow assigning the children to any parent.

It'd be super nice if brakeman could yell about that kind of thing.