Address JSON.parse vulnerabilities

It was recently discovered that the json library's JSON.parse
method is vulnerable to both denial of service and unsafe object
creation.

The simple fix is either to upgrade the json library, or pass
an option when using JSON.parse with an older json library.  Since
Sequel doesn't depend on JSON, we can't require a newer json
library, so I've added a Sequel.parse_json method that runs
the json parsing with the option set, so that user's with an older
json library are not vulnerable through Sequel.  Note that this
option and newer json library changes the behavior when parsing
json such that the json_class entry in the hash is ignored.

Sequel's core does not use JSON parsing at all, but the following
extensions and plugins that Sequel ships with do use the json
library:

* pg_array extension
* pg_json extension
* serialization plugin
* json_serializer plugin

Here's my analysis of impact for each:

pg_array extension: This only uses JSON.parse for performance
reasons to parse an array of integers that PostgreSQL returns.
This commit should not have any behavior change for this extension.

pg_json extension and serialization plugin: These could be affected
if you were storing arbitrary ruby objects in the database and
expected them to be returned as ruby object instances on retrieval.
With this commit, you will get plain hashes on retrieval.

json_serializer plugin: This plugin required significant changes
on the parsing side, since it depended on the previous json parsing
behavior, assuming that JSON.parse would return model objects.
In hindsight, this was a design mistake on my part.  To work
around this behavior, a from_json class method has been added and
can be used as a substitute for JSON.parse, with some extra
security.  However, this method is still dangerous, as any column
values can be set and arbitrary cached associations can also be set.
It is recommended that the from_self instance method be used instead,
or the json be externally validated before use if using the from_self
class method.

If the previous behavior is required in spite of the fact that it is
vulnerable, this will return the previous behavior:

  def Sequel.parse_json(v)
    JSON.parse(v, :create_additions=>true)
  end