backport runner fixes to 3-2-stable

Add a runner hook to Rails::Application and Rails::Engine that requires
ActiveRecord::Base to avoid circular constant loading when using observers.

This commit backports cc7dd66, c0ba0f0 and 8d01c61.
adding test for CVE
do not reset associations when preloading twice.

Closes #9806.

As the `through_options` always contained `{:order=>nil}` the second time,
the preloader ran, the association was always reset. This patch only
adds the `:order` to the `through_options` if it is set.
Merge pull request #9870 from senny/9806_eager_loading_regression

do not reset associations when preloading twice.
use ruby 1.8 Hash syntax [ci skip]
Merge pull request #9873 from senny/use_old_hash_syntax

use ruby 1.8 Hash syntax [ci skip]
test case to assert that associations do not overwrite after create, fixes #9310
Backport #5808

df36c5f - Fix assert_template assertion with :layout option
4bd05a7 - Fix assert_template :layout => nil assertion
0d19a08 - Improve assert_template layout checking
Merge pull request #9899 from macksmind/backport_5808

Backport #5808
Don't reset inheritance_column when setting explicitly.

This is backported from master (cdfcbc4).
Added changelog for 55e2954
Merge pull request #9576 from fredwu/backport_fix_explicitly_inheraitance_column_to_3_2_stable

[Backport to 3-2-stable] Don't reset inheritance_column when setting explicitly.
Fixed test failures on 1.8.7 caused by 74e59ea
Merge pull request #9943 from fredwu/test_fix_for_74e59ea

Fixed test failures on 1.8.7 caused by 74e59ea
Removing explain support warning from the Railtie

This is causing a regression since the Active Record Railtie is trying to
connect to the development database in the application boot.

See https://github.com/rails/rails/pull/6197#issuecomment-15199273
Add attr_accessible to the Getting Started Guide.

This was brought up in #9995, but is only present in 3-2-stable, since
mass assignment is removed from Rails 4.
Fix formatting and minor review in AP changelog

Sentences starting with # are considered headings.
Common behavior with adding formats to lookup_context for TemplateRenderer and PartialRenderer
Chained scopes will be preloaded properly. Fixes #7490
Merge pull request #7792 from seejee/chained_scopes_preload_properly

Fixes Issue #7490: Chained scopes will preload properly