Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Previously the unit values were trusted leading to potential XSS vulnerabilities.

Fixes: CVE-2013-6415
Ensure simple_format escapes its html attributes

The previous behavior equated the sanitize option for simple_format with the
escape option of content_tag, however these are two distinct concepts.

This fixes CVE-2013-6416
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491
Remove dead comment from AS extensions guide [ci skip]
Merge pull request #12123 from aredondo/master

Add regression test for IpSpoofAttackError issue

Closes #10780
updating the changelog
bumping version
fixing changelog
Merge pull request #13143 from joker1007/fix_active_record_callbacks_document_bug

Fix ActiveRecord::Callbacks sample code [ci skip]
Merge pull request #13145 from acapilleri/fix_email_example

fix email regex example code [ci skip]
`connection.type_to_sql` returns a `String` for unmapped types.

Closes #13146.

This fixes an error when using:

```
change_colum :table, :column, :bigint, array: true
```

Conflicts:
	activerecord/CHANGELOG.md
	activerecord/test/cases/adapter_test.rb
Merge branch '4-0-sec' into 4-0-stable

* 4-0-sec:
  fixing changelog
  bumping version
  updating the changelog
  Stop using i18n's built in HTML error handling.
  Deep Munge the parameters for GET and POST
  Ensure simple_format escapes its html attributes
  Escape the unit value provided to number_to_currency
  Only use valid mime type symbols as cache keys

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/lib/action_view/helpers/text_helper.rb
Remove the escaping skip

We are generating safe strings in the paragraph, so we can escape the
tags

Conflicts:
	actionpack/lib/action_view/helpers/text_helper.rb
Merge pull request #13149 from laurocaetano/fix_offset_last

Fix offset with last.

Edit: improve changelog.
Fix documentation of number_to_currency helper

Now users have to explicit mark the unit as safe if they trust it.

Closes #13161

Conflicts:
	actionpack/lib/action_view/helpers/number_helper.rb
	actionpack/test/template/number_helper_i18n_test.rb
Merge pull request #12403 from thedarkone/attr-method-missing-fix

Fix AR#method_missing re-dispatching into overwritten attribute methods

Conflicts:
	activerecord/lib/active_record/attribute_methods.rb
Merge pull request #13152 from mariovisic/text_helper_missing_raw_method

TextHelper#simple_format attempts to call undefined raw method

Edit: add changelog entry.
Use the work "regression" to emphasize the fix [ci skip]