Fix `to_json` false positives

* Don't warn on `params.to_json` if escaped
* Detect Rails 3 config option `config.active_support.escape_html_entities_in_json = true`