Improve poor security recommendation in docs

As reported in #9960, the current documentation recommends an insecure practice for
key generation from a password (a single round of SHA-256). The modified documentation
uses ActiveSupport::KeyGenerator to perform proper key stretching.
Fixes skipping object callback filters

This allows you to skip callbacks that are defined by objects, e.g. for
`ActionController`:

    skip_after_filter MySpecialFilter

Previously this didn't work due to a bug in how Rails compared callbacks
in `Callback#matches?`. When a callback is compiled, if it's an object
filter (i.e. not a method, proc, etc.), `Callback` now defines a method on
`@klass` that is derived from the class name rather than `@callback_id`.
So, when `skip_callback` tries to find the appropriate callback to
remove, `Callback` can regenerate the method name for the filter
object and return the correct value for `Callback#matches?`.
Fix loading of string arrays in postgres
Fix freeze applying to cloned objects

Previously, freezing a cloned ActiveRecord object froze the original
too. By cloning `@attributes` before freezing, we prevent cloned objects
(which in Ruby share state of ivars) from being effected by `#freeze`.

Resolves issue #4936, which has further information on this issue, as
well as steps to reproduce.

* Add a test case for `#freeze` not causing `cloned.frozen?` to be true.
* Clone @attributes before freezing in `ActiveRecord::Core`, then
  reassign the cloned, frozen hash to the frozen model's `@attributes`
  ivar.

/cc @steveklabnik
Fix subject-verb agreement in error msg (and other grammar stuff)
Use secure source for rubygems in engine tests
Merge pull request #10259 from prathamesh-sonpatki/secure-engine-tests

Use secure source for rubygems in engine tests
Merge pull request #10258 from thenickcox/pending_migrations_plural

Fix subject-verb agreement in error msg (and other grammar stuff)
Support transactions in Migrator.run
Avoid leak into controller's action_methods
Merge pull request #10262 from printercu/patch-3

Avoid leak into controller's action_methods
Passing subdomain: '' to url_for removes the subdomain (instead of adding a leading .)
Adding a boolean route constraint checks for presence/absence of request property
Duplicate options before mutating them
Add url generation tests for #10185
Refactor ActionDispatch::Http::URL.build_host_url

Add support for extracting the port from the :host option and for
removing the subdomain by using nil, false or ''.
Add CHANGELOG entries - closes #10180, #10185
Merge pull request #10043 from cconstantine/master

DB with postgres string array column doesn't load fixtures well
Bump arel to 4.0.0
Revert "sprockets 2.9.x doesn't work with uglifier 2.0 yet."

This reverts commit 575838795019f7402992e3bfa83a0c5048cf143d.

Conflicts:
	railties/lib/rails/generators/app_base.rb

Reason: sprockets 2.9.1 fixes this issue
Use latest coffee-rails release