More dialyzer fixes

This batch changes the offending controllers to pass replace_params: false to the CastAndValidate plug which disables overwriting of :params: and :body_params in %Plug.Conn{} so it doesn't trigger dialyzer errors. Instead we fetch these out of the :open_api_spex key under the :private section of the struct.

Now we're down to ~ 30 remaining dialyzer errors that may have a real world impact.