Spurious params framework

[prioux]

This PR adds a new controller directive, 'spurious_params_ban_ip'. In a controller it would look like this:

spurious_params_ban_ip :credits => [], :about_us => []
spurious_params_ban_ip :credits  # same as with an explicit => []

spurious_params_ban_ip :login => [ :username, :password ]

spurious_params_ban_ip :new   => []

You provide to it the names of actions in the current controller, and a list of allowable parameters. If a GET or POST request is made with a bunch of unknown parameters, we know it's not a genuine client, so internally CBRAIN will ban the client's address. This entire mechanism is meant to be useful only for public-facing pages, not for for anything that happens to a logged-in client.

This PR comes with a bunch of pre-defined ban rules for all the public-facing pages.

Currently, to allow so wiggle room, banning happens when at least 3 spurious params are detected.

FOR CODE REVIEWERS: In a dev environement, you'll never end up actually banning yourself, so feel free to try as many weird params as you want. The messages about them will appear in the Rails logs.

[prioux]

I just went through all the logs for 2025 and double checked that the list of allowed params for the actions I am filtering in this PR is all ok. I found I missed the "code" params for OIDC action, so I added it as another commit.