…dations code

Add `Hanami::Action::Params.contract` as a counterpart to `Hanami::Action::Params.params`, allowing `Hanami::Action.contract` to use this API as opposed to directly setting a class-level ivar. This cleans up the remaining “hacky” aspect of my initial `Hanami::Action.contract` introduction.

Secondly, stop using code from `Hanami::Validations` altogether. I always found this code too indirect and hard to follow. Instead, introduce the one bit of important logic (the base validator class permitting the `_csrf_token`) directly into `Hanami::Action::Params`, which means this class is now entirely standalone. This will make it easier to adjust/maintain in future.