Improve poor security recommendation in docs

As reported in #9960, the current documentation recommends an insecure practice for
key generation from a password (a single round of SHA-256). The modified documentation
uses ActiveSupport::KeyGenerator to perform proper key stretching.
Fixes skipping object callback filters

This allows you to skip callbacks that are defined by objects, e.g. for
`ActionController`:

    skip_after_filter MySpecialFilter

Previously this didn't work due to a bug in how Rails compared callbacks
in `Callback#matches?`. When a callback is compiled, if it's an object
filter (i.e. not a method, proc, etc.), `Callback` now defines a method on
`@klass` that is derived from the class name rather than `@callback_id`.
So, when `skip_callback` tries to find the appropriate callback to
remove, `Callback` can regenerate the method name for the filter
object and return the correct value for `Callback#matches?`.
Fix loading of string arrays in postgres
options_from_collection_for_select helper takes html attributes

as the last element of the array
Fix freeze applying to cloned objects

Previously, freezing a cloned ActiveRecord object froze the original
too. By cloning `@attributes` before freezing, we prevent cloned objects
(which in Ruby share state of ivars) from being effected by `#freeze`.

Resolves issue #4936, which has further information on this issue, as
well as steps to reproduce.

* Add a test case for `#freeze` not causing `cloned.frozen?` to be true.
* Clone @attributes before freezing in `ActiveRecord::Core`, then
  reassign the cloned, frozen hash to the frozen model's `@attributes`
  ivar.

/cc @steveklabnik
switch (and lazily convert) ivar names to 3.x
let EXPLAIN use a thread locals registry [John J. Wang & Xavier Noria]

Closes #10198.
Merge pull request #10173 from nashby/element-attributes

options_from_collection_for_select helper takes html attributes
Merge pull request #10239 from rubys/cache_entry_conversion_problems

switch (and lazily convert) ivar names to 3.x
more descriptive NameError's messages for class attributes
Merge pull request #10249 from shime/descriptive_error_messages

more descriptive error messages for class attributes
Bump activerecord-deprecated_finders to 1.0.0
Don't need to add activerecord-deprecated_finders on edge and dev
applications

This gem will not change often to explain it be included in the
application Gemfile
Adding a local thread registry to store local caches.
adding a test for root path in the app
Merge pull request #10250 from wangjohn/local_cache_registry

Adding a local thread registry to store local caches.
add :nodoc: mark to *Registry classes [ci skip]
Add nodoc to LocalCacheRegistry

[ci skip]
Merge pull request #10252 from epiclabs/nodoc_registries

add :nodoc: mark to *Registry classes [ci skip]
activerecord-deprecated_finders 1.0.0 has a bug with has_many :through
associations