Federal regulators hit Bank of America with a $250 million penalty for opening credit-card accounts in customers’ names without their consent and double-charging fees.