Auth token mask from breach-mitigation-rails gem

This merges in the code from the breach-mitigation-rails gem that masks
authenticity tokens on each request by XORing them with a random set of
bytes. The masking is used to make it impossible for an attacker to
steal a CSRF token from an SSL session by using techniques like the
BREACH attack.

The patch is pretty simple - I've copied over the [relevant
code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb)
and updated the tests to pass, mostly by adjusting stubs and mocks.
Use web-console 2.0.0.beta2 on new apps
Synced Active Model changelogs [ci skip]

Godfrey Chan, Genadi Samokovarov
Point to right sass-rails version
Fix setting simple values to the new config.x

Previously setting simple values to the config.x object resulted in the
following:

    config.x.super_debugger = true
    config.x.super_debugger #=> {}

Which was against the examples showed in the changelog/release notes.
Use the released turbolinks gem
Synced Active Support release notes [ci skip]

[Godfrey Chan, Genadi Samokovarov]
Merge pull request #16570 from bradleybuda/breach-mitigation-mask-csrf-token

CSRF token mask from breach-mitigation-rails gem
Synced AR release notes [ci-skip]
Fix blank link on config/application.rb app template [ci skip]
Fix failing railties tests

A combination of two commits led into these failures:

* The addition of a new active_record config in
  24bb8347b6ff0da90059314d9aece7a2c94a272c
* The revert of the config to use config.x as options holder in
  43073b393d234acd094ac7c220163f4e419d11f5

These tests remove activerecord from the load path, however the
configuration is still in the application file, and they blow up.
Major features in 4.2 release notes [ci skip]
List the 4.2 release notes in the index, mark it as WIP [ci skip]
Clearly mark these as WIP, and invite people to contribute. [ci skip]
Some placeholders for the 4.2 upgrade guide [ci skip]
:bomb: oops, it should be 4.2 that's WIP [ci skip]
:nail_care: The note doesn't look good on the blue background [ci skip]
Copy & paste fail [ci skip]
Create a group to active job gems
Add `set_delivery_method` and `restore_delivery_method` to `ActionMailer::TestCase`.

This way these methods are available outside the ActionMailer test suite, but
they are still duplicated inside `test/abstract_unit` for test cases that don't
inherit from the `ActionMailer::TestCase` class.