ActionDispatch:SSL: don't include STS header in non-https responses
Flag cookies as secure with ignore case in ActionDispatch::SSL
Add CHANGELOG entry for #10971

[ci skip]

Conflicts:
	actionpack/CHANGELOG.md
Merge pull request #11065 from gbuesing/hstsfix

ActionDispatch:SSL: don't include STS header in non-https responses
Merge pull request #11069 from ykzts/actiondispatch-ssl-secure-flag-igonore-case

Flag cookies as secure with ignore case in ActionDispatch::SSL
test-case => failing
Fix shorthand routes where controller and action are in the scope

Merge `:action` from routing scope and assign endpoint if both `:controller`
and `:action` are present. The endpoint assignment only occurs if there is
no `:to` present in the options hash so should only affect routes using the
shorthand syntax (i.e. endpoint is inferred from the the path).

Fixes #9856
Clarify what arguments are passed to redirect blocks - fixes #11056