active_record: Type cast booleans and durations for string columns.

@rafaelfranca, @sgrif, @arthurnn this is a basically a rebase of pull #14894 which was closed without the problem being completely fixed.

## Problem

Pull #16037 partially fixed the problem is described in [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) by quoting Numeric types, however, that pull request missing the need to quote boolean and ActiveSupport::Duration types.

For example:

```ruby
User.where(:login_token=>params[:token]).first
```
can be exploited by passing in `false` for `params[:token]` through a JSON body causing the query
```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```
to match any login_token that starts with a non-digit character.

Quoting for these additional types was properly handled in mistakenly closed pull request #14894.

## Solution

ActiveRecord::Type::String#type_cast_for_database has been updated to handle these types.  Tests are included for these missed types as well as the numeric types which are already quoted properly to prevent regressions.
(I *think* `where` is the only method that is "safe" to pass user input to which doesn't go through `type_cast_from_user`)