Update CHANGES

* Add support for RailsLTS 2.3.18.7 and 2.3.18.8
* Add support for Rails 4 `before_actions` and friends
* Move SQLi CVE checks to `CheckSQLCVEs`
* Check for protected_attributes gem
* Fix SQLi detection in chain calls in scopes
* Add GitHub-flavored Markdown output format (Greg Ose)