Resolve issue with security mass assignment

[Lubosky]

📝 A short description of the changes

Resolved issues flagged by Brakeman concerning mass assignment. Solved by whitelisting keys allowed to be updated.

https://github.com/bitzesty/qae/security/code-scanning/23
https://github.com/bitzesty/qae/security/code-scanning/24

🔗 Link to the relevant story (or stories)

Asana card here: https://app.asana.com/0/1200504523179343/1207221131279488/f

Deployment implications

None.

✅ Checklist

• Features that cannot go live are behind a feature flag/env var or specify deploy date and open PR as draft
• I have checked that commit messages make sense and explain the reasoning for each change
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have squashed any unnecessary or part-finished commits

🖼️ Screenshots (if appropriate - no PII/Prod data):