Escape multibyte line terminators in JSON encoding

Currently, json/encoding respects the JSON spec (as it should) which 
disallows \n and \r inside strings, escaping them as expected.

Unfortunately, ECMA-262 (Javascript) disallows not only \n and \r in 
strings, but "Line Terminators" which includes U+2028 and U+2029. 
See here: http://bclary.com/2004/11/07/#a-7.3

This pull request adds U+2028 and U+2029 to be escaped.

# Why? 

It's very common to see something like this in a Rails template:

<script type="text/javascript"> 
var posts = <%= @posts.to_json %>;
</script>

If U+2028 or U+2029 are part of any attributes output in the to_json
call, you will end up with an exception.
In Chrome: Uncaught SyntaxError: Unexpected token ILLEGAL 

# Why not?

This is JSON encoding, and the JSON spec is specific about how to 
encode strings. U+2028 and U+2029 don't get special treatment.

Just trying to start a discussion... what do you do in your apps
to deal with this? Is there a convention I'm missing?
Added escaping of U+2028 and U+2029 inside the json encoder.

U+2028 and U+2029 are allowed inside strings in JSON (as all literal
Unicode characters) but JavaScript defines them as newline
seperators. Because no literal newlines are allowed in a string, this
causes a ParseError in the browser. We work around this issue by
replacing them with the escaped version. The resulting JSON is still
valid and can be parsed in the browser.

This commit has been coauthored with Viktor Kelemen @yikulju
sort => sort! on new array
[ci skip] document protect_against_forgery? method
Merge pull request #10510 from think602/master

[ci skip] document protect_against_forgery? method
Set the inverse when association queries are refined

Suppose Man has_many interests, and inverse_of is used.

Man.first.interests.first.man will correctly execute two queries,
avoiding the need for a third query when Interest#man is called. This is
because CollectionAssociation#first calls set_inverse_instance.

However Man.first.interests.where("1=1").first.man will execute three
queries, even though this is obviously a subset of the records in the
association.

This is because calling where("1=1") spawns a new Relation object from
the CollectionProxy object, and the Relation has no knowledge of the
association, so it cannot set the inverse instance.

This commit solves the problem by making relations spawned from
CollectionProxies return a new Relation subclass called
AssociationRelation, which does know about associations. Records loaded
from this class will get the inverse instance set properly.

Fixes #5717.

Live commit from La Conf! :sparkles:
Merge pull request #10543 from vipulnsward/to_sort

Can you improve the commit message a little bit? It's good to describe why the change is happening.
Fix that #exists? can produce invalid SQL: "SELECT DISTINCT DISTINCT"

The combination of a :uniq => true association and the #distinct call
in #construct_limited_ids_condition combine to create invalid SQL, because
we're explicitly selecting DISTINCT, and also sending #distinct on to AREL,
via the relation#distinct_value.

Rather than build a select distinct clause in #construct_limited_ids_condition,
I set #distinct! and pass just the columns into the select statement.
This requires introducing a #columns_for_distinct method to return the
select columns but not the statement itself.
Don't try to EXPLAIN select_db calls
Merge pull request #10553 from dasch/dasch/dont-try-to-explain-select_db

Don't try to EXPLAIN select_db calls
Merge pull request #6792 from Empact/postgres-distinct

Fix that #exists? can produce invalid SQL: "SELECT DISTINCT DISTINCT"
Move #proxy_association method to AssociationRelation
Reject blank order_values within #columns_for_distinct, as the orders aren't used at all on non-postgres adapters.
Move the except(:select) inside the construct_limited_ids_condition method to pair it closely with its motivation.
Simplify conditions within apply_join_dependency
Pull the excepts into apply_join_dependency, for the sake of DRY.
DRY-up join dependency creation by extracting construct_join_depdency
In #apply_join_dependency, we can apply the #where in-place because relation is always a new object.

Thanks to the #except we call at the top of the method.
Extract JoinDependency#join_relation to DRY the repeated application of the #join_associations.
Merge pull request #10558 from Empact/cleanup-finder-methods

Cleanup finder methods