Don't require phi_access logging for `new` models

Sometimes you just want a transitory `MyModel.new(params).method_call`

It's super annoying to have to assign a variable just to allow phi on the params you're already touching and are unprotected anyway.

We shouldn't 'engage' PHI_Attrs until it's been saved to the database.

Start by locating the PHI_Attrs behavior triggered when a model is initialized and when it is saved. Verify that MyModel.new(params).method_call does not require PHI access logging before persistence, while access to a saved model remains logged.

Written by the indexing model from the issue text.