Enable Exception Fallback/Failsafe Behavior

Right now we have a default error handling app `ActionDispatch::PublicExceptions` that renders the static 404 & 500 pages. If you don't like it you can override this behavior by specifying an exceptions app in the config of your application using `config.exceptions_app`. Right now if you do so, and you have an exception in your exceptions app, your users will not see your 404 or 500 pages, but instead a FAILSAFE_RESPONSE that simply renders some text.

This change gives the ability to have MULTIPLE fallback apps. So anyone can write exception handling apps, and if those apps fail, it will continue to try to use the public app. This design also allows the developer to specify additional apps if they choose.

There are two key things in this PR, first that this fallback behavior to the public exceptions app is automatic, and second that by default you can specify multiple error rendering apps.

This is an alternative implementation of an existing PR #7804 made at the behest of @jeremy. I believe this is a cleaner implementation.

ATP railties and actionpack cc/ @rafael @rafaelfranca @spastorino @steveklabnik