Merge pull request #14097 from chancancode/sync_4_1_release_notes

Sync 4.1 release notes with changes since 7f648bc7
Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081
Correctly escape PostgreSQL arrays.

Thanks Godfrey Chan for reporting this!

Fixes: CVE-2014-0080
Preparing for 4.1.0.beta2 release
Merge branch '4-1-0-beta2'

Conflicts:
	actionview/CHANGELOG.md
	activerecord/CHANGELOG.md
Use the reference for the mime type to get the format

Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.

Fixes: CVE-2014-0082
Typo fix for unscope
Merge pull request #14098 from Amit-Thawait/master

Typo fix for unscope [ci skip]
Update Docs in favor to use render plain instead of text option
ref #14062
Merge pull request #14099 from robertomiranda/render-text-2-plain

Update Docs in favor to use render plain instead of text option
Fix render plain docs example in AM::Base

The errors were introduced in e220a34e39
Fixed STI classes not defining an attribute method if there is a
conflicting private method defined on its ancestors.

The problem is that `method_defined_within?(name, klass, superklass)`
only works correclty when `klass` and `superklass` are both `Class`es.

If both `klass` and `superklass` are both `Class`es, they share the
same inheritance chain, so if a method is defined on `klass` but not
`superklass`, this method must be introduced at some point between
`klass` and `superklass`.

This does not work when `superklass` is a `Module`. A `Module`'s
inheritance chain contains just itself. So if a method is defined on
`klass` but not on `superklass`, the method could still be defined
somewhere upstream, e.g. in `Object`.

This fix works by avoiding calling `method_defined_within?` with a
module while still fufilling the requirement (checking that the
method is defined withing `superclass` but not is not a generated
attribute method).

4d8ee288 is likely an attempted partial fix for this problem. This
unrolls that fix and properly check the `superclass` as intended.

Fixes #11569.