Fix UserParameters#without being a no-op

[dylangriffinshub]

Summary

Fixes #7067 — UserParameters#without compared symbol keys against ActionController::Parameters#reject!'s string keys, so its condition was always false and the method silently removed nothing. It also didn't return self, breaking the builder chain.

The only caller, CreateCasaAdminService#build, calls .without(:active, :type) expecting both to be stripped before CasaAdmin.new. Because the call was a no-op:

• Any authenticated user could set active=false on a new admin via an extra field in the create request (DB default is true).
• Passing type=<sibling class> raised an unrescued ActiveRecord::SubclassNotFound (500), since Rails' STI guard is the only thing preventing type escalation.

Fix

without now stringifies the incoming keys before comparing (matching how reject! yields keys), and returns self so it can still be chained.

Also replaces the pending stub in spec/values/user_parameters_spec.rb with real coverage for without, without_type, without_active, with_organization, and with_password.

Test plan

• bundle exec rspec spec/values/user_parameters_spec.rb
• Manually verify: as a volunteer/supervisor, POST /casa_admins with an extra type or active field no longer leaks through