Lowercase param keys in canUpdateParam() and setParamValue() so the guard and the setting lookup agree, and reject keys outside the canonical charset, matching the read path.
