fix($resource): pass all extra, owned properties as params

Previously, a property would not be passed as query param, if `Object.prototype` had a property with
the same name.

Fixes #14866
Closes #14867

BREAKING CHANGE:

All owned properties of the `params` object that are not used to replace URL params, will be passed
to `$http` as `config.params` (to be used as query parameters in the URL), even if
`Object.prototype` has a property with same name. E.g.:

Before:

```js
var Foo = $resource('/foo/:id');
Foo.get({id: 42, bar: 'baz', toString: 'hmm'});
    // URL: /foo/42?bar=baz
    // Note that `toString` is _not_ included in the query,
    // because `Object.prototype.toString` is defined :(
```

After:

```js
var Foo = $resource('/foo/:id');
Foo.get({id: 42, bar: 'baz', toString: 'hmm'});
    // URL: /foo/42?bar=baz&toString=hmm
    // Note that `toString` _is_ included in the query, as expected :)
```

src/ngResource/resource.js

@@ -535,7 +535,7 @@ angular.module('ngResource', ['ng']).
             encodedVal,
             protocolAndDomain = '';
 
-          var urlParams = self.urlParams = {};
+          var urlParams = self.urlParams = Object.create(null);
           forEach(url.split(/\W/), function(param) {
             if (param === 'hasOwnProperty') {
               throw $resourceMinErr('badname', "hasOwnProperty is not a valid parameter name.");

test/ngResource/resourceSpec.js

@@ -1363,6 +1363,49 @@ describe("basic usage", function() {
   });
 });
 
+describe('extra params', function() {
+  var $http;
+  var $httpBackend;
+  var $resource;
+
+  beforeEach(module('ngResource'));
+
+  beforeEach(module(function($provide) {
+    $provide.decorator('$http', function($delegate) {
+      return jasmine.createSpy('$http').and.callFake($delegate);
+    });
+  }));
+
+  beforeEach(inject(function(_$http_, _$httpBackend_, _$resource_) {
+    $http = _$http_;
+    $httpBackend = _$httpBackend_;
+    $resource = _$resource_;
+  }));
+
+  afterEach(function() {
+    $httpBackend.verifyNoOutstandingExpectation();
+  });
+
+
+  it('should pass extra params to `$http` as `config.params`', function() {
+    $httpBackend.expectGET('/bar?baz=qux').respond('{}');
+
+    var R = $resource('/:foo');
+    R.get({foo: 'bar', baz: 'qux'});
+
+    expect($http).toHaveBeenCalledWith(jasmine.objectContaining({params: {baz: 'qux'}}));
+  });
+
+  it('should pass extra params even if `Object.prototype` has properties with the same name',
+    function() {
+      $httpBackend.expectGET('/foo?toString=bar').respond('{}');
+
+      var R = $resource('/foo');
+      R.get({toString: 'bar'});
+    }
+  );
+});
+
 describe('errors', function() {
   var $httpBackend, $resource, $q;