4.0: Deprecate `accept [:*]` and remove from docs

[RoyalIcing]

As we all discussed on Alembic Slack:

the fact that people mark fields as public to be writeable and then can accidentally expose fields defeats the entire purpose of the change to private by default

security can sometimes be annoying but having an allowlist is always always safer than having a denylist

Like how when you delete a repo on GitHub it makes you type out the repo name.