Move pk initialization logic onto `AttributeSet`

Better encapsulates its internals from `ActiveRecord::Base`.
Fix typo
[ci skip] Changes some wording to better foreshadow what is coming up later.
This should prevent some anxiety readers may experience when the doc goes into something different than what it just explained. Also clarifies a statement about priority in engines and application environments

[ci skip] fixes double `the`

[ci skip] more clarifications

[ci skip] changes from tics to quotes
Fix SQL injection when querying against ranges and bitstrings

Fix CVE-2014-3483 and protect against CVE-2014-3482.
Quote range strings when quoting PG ranges

The test case for CVE-2014-3483 doesn't actually send the generated SQL
to the database. The generated SQL is actually invalid for real inputs.
Merge pull request #16022 from sgrif/sg-range-quoting

Quote range strings when quoting PG ranges
Merge pull request #16015 from sgrif/sg-ensure-initialized

Move pk initialization logic onto `AttributeSet`

Conflicts:
	activerecord/lib/active_record/attribute_set.rb
automatically include ActiveModel::Validations when include ActiveModel::SecurePassword
Merge pull request #16024 from aditya-kapoor/include-validations

automatically include ActiveModel::Validations when include ActiveModel::SecurePassword
`DateTime#to_f` now preserves fractional seconds.

Previously this method always returns `.0` in the fractional part. This commit
changes it to preserve the fractional seconds instead.

Fixes #15994.
Merge pull request #16001 from johnpaulashenfelter/jp_fix_datetime_to_f

`DateTime#to_f` now preserves fractional seconds.
Only automatically include validations when enabled

This is a follow up to #16024.
Fix escape_once double-escaping hex-encoded entities

(This is a manual merge of #9102)
The hex escape sequence can be of any length
Add CHANGELOG for c803b90
Change the JSON renderer to enforce the 'JS' Content Type

The controller can set the response format as 'JSON' before the renderer code be
evaluated, so we must replace it when necessary.

Fixes #15081
Merge pull request #16026 from lucasmazza/lm-respond-to-jsonp-fix

Change the JSON renderer to enforce the 'JS' Content Type
Fix typo in comment
Merge pull request #16029 from cade/fix_typo_in_comment

Fix typo in comment
Merge pull request #15941 from variousred/docrails-changes

[ci skip] Changes some wording to better foreshadow what is coming up later