backport runner fixes to 3-2-stable

Add a runner hook to Rails::Application and Rails::Engine that requires
ActiveRecord::Base to avoid circular constant loading when using observers.

This commit backports cc7dd66, c0ba0f0 and 8d01c61.
adding test for CVE
Update CHANGELOGs for 3.2.13 release.
Preparing for 3.2.13.rc1 release
Fix issue #7526. Reload the target if it's stale.

* This has been fixed at master via `365b8b6`, but not at 3-2-stable branch.

* @stale_state should be nil when a model isn't saved. via `0f3901e`.

* set @stale_state to nil when reset the target.
Freeze columns only once per Result

Conflicts:
	activerecord/lib/active_record/result.rb
Revert "Merge pull request #8209 from senny/backport_8176"

This reverts commit 724020278480855bddfe749c91f1074d4f50f3c6, reversing
changes made to e4e2bcce75b85fb8c1c49509a17bd5dfe6034c32.

Conflicts:
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/relation/calculations.rb
	activerecord/test/cases/calculations_test.rb
bumping to rc2
Use shorter prefix and suffix as in Oracle database identifier
cannot be larger than 30 characters
Merge pull request #9594 from yahonda/3-2-stable_prefix_suffix

Use shorter prefix and suffix to support Oracle adapter
Merge pull request #9549 from larrylv/reload-stable-target-before-saving

Fix issue #7526. Reload the association target if it's stale.
@target might be nil when Identity Map is enabled.

* With Identity Map enabled, NameError might be raised and @target is
  nil. So we should always ensure `@target ||= find_target`.

* Only force reload target when it is stale.
Merge pull request #9600 from larrylv/fix-load-target-with-identity-map-on

@target might be nil when Identity Map is enabled.
Using latest AR-JDBC for JRuby

1.2.5 and 1.2.6 are bad ones
Merge pull request #9609 from arunagw/using-latest-arjdbc

Using latest AR-JDBC for JRuby
Removing FIXME

As we did in master.
Merge pull request #9613 from arunagw/remove_fixme

Removing FIXME
Merge pull request #9616 from exviva/multiple_select_name_double_square_brackets

Fix incorrectly appended square brackets to a multiple select box

Before:

    select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
    # => <select name="post[category][][]" ...>

After:

    select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
    # => <select name="post[category][]" ...>

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/lib/action_view/helpers/tags/base.rb
	actionpack/test/template/form_options_helper_test.rb
Merge pull request #9616 from exviva/multiple_select_name_double_square_brackets

Fix incorrectly appended square brackets to a multiple select box

Before:

    select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
    # => <select name="post[category][][]" ...>

After:

    select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
    # => <select name="post[category][]" ...>

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/lib/action_view/helpers/tags/base.rb
	actionpack/test/template/form_options_helper_test.rb
Fix `ActiveSupport::TimeZone.parse` when time is a local DST jump

The previous implementation `ActiveSupport::TimeZone.parse` used `Time.parse`
which applies the system time DST rules to the parsed time. Instead we now
use `Time.utc` and manually apply the offset.

Backport tests from:
005d910624bbfa724b638426a000c8074d4201a2
c89b6c4cdce7ee55ed3665c099d914222fe0344a
03becb13099c439f6aea5058546bc8b0b19b8db8

Fixes #9678.