Parse '{"person":[null]}' JSON as {'person' => []}. Attempts to solve #8832

We're also affected by #8832. I guess `[]` is replaced with `nil` for a reason, but I can't figure out how this would be a security risk. Could someone please help me understand the 'args injection' problem?

FWIW, the AR tests are still passing at https://github.com/rails/rails/commit/d5cd97baa44fa66dc681041a213092b45c57c32#L7R27.