Before we would block the `sign_out` request when the user did not
accept the terms, therefore redirecting them to the terms again.

By allowing all request to devise controllers, we avoid this problem.

This enforces the terms in the web application. These cases are
specced:

- Logging in: When terms are enforced, and a user logs in that has not
  accepted the terms, they are presented with the screen. They get
  directed to their customized root path afterwards.
- Signing up: After signing up, the first screen the user is presented
  with the screen to accept the terms. After they accept they are
  directed to the dashboard.
- While a session is active:
  - For a GET: The user will be directed to the terms page first,
    after they accept the terms, they will be directed to the page
    they were going to
  - For any other request: They are directed to the terms, after they
    accept the terms, they are directed back to the page they came
    from to retry the request. Any information entered would be
    persisted in localstorage and available on the page.

This commit fixes the error:
```
  1) Projects::TodosController Merge Requests POST create when not authorized for merge_request doesn't create todo
     Failure/Error: application_trace = ActionDispatch::ExceptionWrapper.new(env, exception).application_trace

     NoMethodError:
       undefined method `clean' for #<Hash:0x000055be5bda35d0>
       Did you mean?  clear
     # ./app/controllers/application_controller.rb:113:in `log_exception'
     # ./app/controllers/application_controller.rb:40:in `block in <class:ApplicationController>'
     # ./spec/controllers/projects/todos_controller_spec.rb:80:in `go'
     # ./spec/controllers/projects/todos_controller_spec.rb:138:in `block (6 levels) in <top (required)>'
     # ./spec/controllers/projects/todos_controller_spec.rb:138:in `block (5 levels) in <top (required)>'
     # ------------------
     # --- Caused by: ---
     # ActiveRecord::RecordNotFound:
     #   Couldn't find MergeRequest
     #   ./app/finders/concerns/finder_methods.rb:19:in `raise_not_found_unless_authorized'

Finished in 7.53 seconds (files took 12.8 seconds to load)
1 example, 1 failure
```

Also see https://github.com/rails/rails/commit/6d85804bc6aeecce5669fb4b0d7b33c069deff3a

Rails 5.0 requires to explicitly permit attributes when building a URL
using current `params` object.

The `safe_params` helper allows developers to just call `safe_params.merge(...)`
instead of manually adding `permit` to every call.

https://github.com/rails/rails/pull/20868

The default 404 handler would return the Content-Type format based on the
given format extension. This would cause the Rails CSRF protection to flag an
error, since the .js extension gets mapped to text/javascript format.

Closes #40771