active_record: Type cast booleans and durations for string columns.

@rafaelfranca, @sgrif, @arthurnn this is a basically a rebase of pull #14894 which was closed without the problem being completely fixed.

## Problem

Pull #16037 partially fixed the problem is described in [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) by quoting Numeric types, however, that pull request missing the need to quote boolean and ActiveSupport::Duration types.

For example:

```ruby
User.where(:login_token=>params[:token]).first
```
can be exploited by passing in `false` for `params[:token]` through a JSON body causing the query
```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```
to match any login_token that starts with a non-digit character.

Quoting for these additional types was properly handled in mistakenly closed pull request #14894.

## Solution

ActiveRecord::Type::String#type_cast_for_database has been updated to handle these types.  Tests are included for these missed types as well as the numeric types which are already quoted properly to prevent regressions.
Ideally the contract is that we only accept values that `type_cast_from_user` or `type_cast_from_database` return. Method like `where` and `update_all` bypass normal type casting at the moment. 

The reason this can't `to_s` everything yet is because of some weirdness in serialized attributes which I plan on looking into today.