Address CVE-2014-4671 (JSONP Flash exploit)

Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
Force encoding of US-ASCII to UTF-8 in unescape_uri.

Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
Merge pull request #16123 from karlentwistle/issues/9299

Force encoding of US-ASCII to UTF-8 in unescape_uri.
Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
* gcampbell-rosetta_flash:
  Address CVE-2014-4671 (JSONP Flash exploit)
Dump PostgreSQL primary key with custom function as a default.

For example, if use pgcrypto extension in PostgreSQL 9.4 beta 1, where
uuid-ossp extension isn't available for moment of writing, and thus to
use a gen_random_uuid() method as a primary key default.

In this case schema dumper wasn't able to correctly reconstruct
create_table statement and lost primary key constraint on schema load.

Fixes #16111.