Make _attach_current_user a pure function

Mutating dictionaries is gross and doesn’t work as you’d expect. Better
to have the function return a new dictionary instead.

Means we can be explicit that `created_by` is one of the allowed params
when updating a service.

app/notify_client/api_key_api_client.py

@@ -30,7 +30,7 @@ class ApiKeyApiClient(BaseAPIClient):
             'name': key_name,
             'key_type': key_type
         }
-        _attach_current_user(data)
+        data = _attach_current_user(data)
         key = self.post(url='/service/{}/api-key'.format(service_id), data=data)
         return key['data']