Allow passing an incomplete json when creating a proposal

Until now, when creating a proposal with some existing json, it was
required that the json contained a full proposal definition. Two big
downsides of this are:

 a) it's easy to break stuff by accident when changing a proposal
 b) if the schema changes to add new mandatory attributes, people can
    not simply re-use old json they had around; they have to update them

This commit allows passing an incomplete json with only a subset of
attributes. It will take the default json, and overwrite any attribute
there with the ones from the incomplete json.

Such an incomplete json must have a crowbar-deep-merge-template toplevel
attribute set to true. Otherwise, the old behavior is kept.

Note that this is not using Chef::Mixin::DeepMerge::deep_merge! as a
deep merge is also merging arrays in attribute values, which is
something not desired here. The hash_only_merge! API is actually
available in Chef 11 in Chef::Mixin::DeepMerge, so this is just a
backport.

For all that matters, this is backwards-compatible.
Merge pull request #589 from vuntz/allow-incomplete-proposals

Allow passing an incomplete json when creating a proposal
[Security] Upgrade from Rails 2.3.17 to 2.3.18

Update to latest Rails 2.3.x stable release. Fixes the following CVEs:

  * CVE-2013-1854 Symbol DoS vulnerability in Active Record
  * CVE-2013-1855 XSS vulnerability in sanitize_css in Action Pack
  * CVE-2013-1856 XML Parsing Vulnerability affecting JRuby users
  * CVE-2013-1857 XSS Vulnerability in the sanitize helper of Ruby on
    Rails

http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
Merge pull request #598 from jamestyj/release/pebbles/master-rails-2.3.18

[Security] Upgrade from Rails 2.3.17 to 2.3.18