Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081
Correctly escape PostgreSQL arrays.

Thanks Godfrey Chan for reporting this!

Fixes: CVE-2014-0080
Preparing for 4.0.3 release
Merge pull request #12664 from jetthoughts/12242_includes_in_through_association

Skip `include_values` from through associations chains for building association scope
Conflicts:
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/associations/association_scope.rb
Fix controller test not resetting @_url_options

Commit 4f2cd3e9 introduced a bug by reordering the call to
`@controller.recycle!` above the call to `build_request_uri`. The
impact of this was that the `@_url_options` cache ends up not being
reset between building a request URI (occurring within the test
controller) and the firing of the actual request.

We encountered this bug because we had the following setup:

  class MinimumReproducibleController < ActionController::Base
    before_filter { @param = 'param' }

    def index
      render text: url_for(params)
    end

    def default_url_options
      { custom_opt: @param }
    end
  end

  def test_index
    get :index # builds url, then fires actual request
  end

The initial call to `get :index` in the test suite would populate the
@_url_options cache. The subsequent call to `url_for` would depend on
the cache, thus never calling the now-updated default_url_options.

This commit fixes this bug calling recycle! twice, and removes a call
to set response_body, which should no longer be needed since we're
recycling the request object explicitly.
Merge pull request #13886 from arthurnn/fix_relation_arel

This fixes a regression that is causing a bug in our
lib/advanced_batches.rb

The original commit message: Fix regression on .select method