Check attributes passed to create_with and where

If the request parameters are passed to create_with and where they can
be used to do mass assignment when used in combination with
Relation#create.

Fixes CVE-2014-3514
Preparing for 4.0.9 release
Revert "Revert "Merge pull request #11120 from awilliams/ar_mysql2_boolean_quoting""

This reverts commit 12891e98a6c6af43bd8eda0b9eecfe5b14500670.

Re-applying this fixes validates_uniqueness_of on boolean columns.