active_record: Type cast booleans and durations for string columns.

@rafaelfranca, @sgrif, @arthurnn this is a basically a rebase of pull #14894 which was closed without the problem being completely fixed.

## Problem

Pull #16037 partially fixed the problem is described in [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) by quoting Numeric types, however, that pull request missing the need to quote boolean and ActiveSupport::Duration types.

For example:

```ruby
User.where(:login_token=>params[:token]).first
```
can be exploited by passing in `false` for `params[:token]` through a JSON body causing the query
```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```
to match any login_token that starts with a non-digit character.

Quoting for these additional types was properly handled in mistakenly closed pull request #14894.

## Solution

ActiveRecord::Type::String#type_cast_for_database has been updated to handle these types.  Tests are included for these missed types as well as the numeric types which are already quoted properly to prevent regressions.
Could we just `to_s` *everything* at this point? Or whitelist the things that we shouldn't?

AFAICS, something along those lines is necessary in order to honour `type_cast_for_database`'s contract: we're obliged to accept any `value`, but only permitted to return an instance of one of a few classes.