config.ru uses the effective Rack app

We used to pass the Rails::Application subclass to #run.
The Rails server then called #to_app to convert that class to the
actual Rack application.

if you surround `#run` with a call to `#map` the server no longer
convertes the class to the instance and we end up with unnecessary
delegation calls on every request.
stop calling to_sym when building arel nodes [CVE-2013-1854]
fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
JDOM XXE Protection [CVE-2013-1856]
fix protocol checking in sanitization [CVE-2013-1857]
Include I18n fallbacks in :locale lookup context
move tests out from base_test.rb

These tests should be in inheritance_test.rb since its testing a
feature which is implemented in inheritance.rb
fix some typos found in activemodel
SQLite3 3.6.8+ supports nested transactions [ci skip]

http://www.sqlite.org/lang_savepoint.html
https://github.com/rails/rails/blob/master/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb#L130-L132
refer to the contributing guide on how to create issues.
Merge pull request #9773 from senny/how_to_report_an_issue

refer to the contributing guide on how to create issues.
fix repeat of test; remove unused variable by use of each_key
Merge pull request #9677 from neerajdotname/update-comments-about-kotori

SQLite3 3.6.8+ supports nested transactions [ci skip]
Merge pull request #9765 from tkhr/mv-tests-out-from-base_testrb

Move tests out from base_test.rb to inheritance_test.rb
remove ancient TODOs [ci skip].
Merge pull request #9771 from vipulnsward/fix_typos_activemodel_v1

Fix some typos found in activemodel
Merge pull request #9766 from senny/remove_ancient_todos

Remove ancient TODOs [ci skip]
Merge pull request #9763 from vipulnsward/fix_transliterate_test

Fix repeat of test; remove unused variable by use of each_key
Merge pull request #9753 from jbarreneche/bug/render-locale-fallbacks

i18n locale fallback for localized views
`TimeWithZone` raises `NoMethodError` in proper context.

Closes #9772.

`TimeWithZone` delegates everything to the wrapped `Time` object
using `method_missing`. The result is that `NoMethodError` error
will be raised in the context of `Time` which leads to a misleading
debug output.