Remove the use of String#% when formatting durations in log messages

@strzalek patch downloaded form https://groups.google.com/forum/#!topic/ruby-security-ann/yvlR1Vx44c8

This avoids potential format string vulnerabilities where user-provided
data is interpolated into the log message before String#% is called.

Conflicts:
	actionpack/lib/action_controller/log_subscriber.rb

Conflicts:
	actionpack/lib/action_controller/log_subscriber.rb

Signed-off-by: Neal Harris <neal@squareup.com>