backport runner fixes to 3-2-stable

Add a runner hook to Rails::Application and Rails::Engine that requires
ActiveRecord::Base to avoid circular constant loading when using observers.

This commit backports cc7dd66, c0ba0f0 and 8d01c61.
adding test for CVE
Update CHANGELOGs for 3.2.13 release.
Preparing for 3.2.13.rc1 release
Freeze columns only once per Result

Conflicts:
	activerecord/lib/active_record/result.rb
remove unused path_without_format variable

Was forgotten in a72dab0.
Fix typo on CHANGELOG.md
Merge pull request #9528 from korny/patch-1

Fix unused variable warning in mapper.rb
Merge pull request #9531 from erik-escobedo/patch-1

Fix typo on ActionPack's ChangeLog
Fix issue #7526. Reload the target if it's stale.

* This has been fixed at master via `365b8b6`, but not at 3-2-stable branch.

* @stale_state should be nil when a model isn't saved. via `0f3901e`.

* set @stale_state to nil when reset the target.
Backport fixes about #7774 to 3-2-stable

Fix ActionDispatch::Request#formats when HTTP_ACCEPT header is an empty
string.
Merge pull request #9543 from maximerety/backport_fix_7774

Backported #7774 to 3-2-stable
Freeze columns only once per Result

Conflicts:
	activerecord/lib/active_record/result.rb
Update CHANGELOGs for 3.2.13.rc1
Revert "Merge pull request #8209 from senny/backport_8176"

This reverts commit 724020278480855bddfe749c91f1074d4f50f3c6, reversing
changes made to e4e2bcce75b85fb8c1c49509a17bd5dfe6034c32.

Conflicts:
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/relation/calculations.rb
	activerecord/test/cases/calculations_test.rb
bumping to rc2
Use shorter prefix and suffix as in Oracle database identifier
cannot be larger than 30 characters
Merge pull request #9594 from yahonda/3-2-stable_prefix_suffix

Use shorter prefix and suffix to support Oracle adapter
Merge pull request #9549 from larrylv/reload-stable-target-before-saving

Fix issue #7526. Reload the association target if it's stale.
@target might be nil when Identity Map is enabled.

* With Identity Map enabled, NameError might be raised and @target is
  nil. So we should always ensure `@target ||= find_target`.

* Only force reload target when it is stale.