Correctly determine if migration is needed.

This method would assume that if last migration in the migrations
directory matched the current schema version, that the database was up
to date, but this does not account for new migrations with older
timestamps that may be pending.
Make `AC::Params#to_h` return Hash with safe keys

`ActionController::Parameters#to_h` now returns a `Hash` with
unpermitted keys removed. This change is to reflect on a security
concern where some method performed on an `ActionController::Parameters`
may yield a `Hash` object which does not maintain `permitted?` status.
If you would like to get a `Hash` with all the keys intact, duplicate
and mark it as permitted before calling `#to_h`.

    params = ActionController::Parameters.new(name: 'Senjougahara Hitagi')
    params.to_h # => {}

    unsafe_params = params.dup.permit!
    unsafe_params.to_h # => {"name"=>"Senjougahara Hitagi"}

    safe_params = params.permit(:name)
    safe_params.to_h # => {"name"=>"Senjougahara Hitagi"}

This change is consider a stopgap as we cannot chage the code to stop
`ActionController::Parameters` to inherit from
`HashWithIndifferentAccess` in the next minor release.

Also, adding a CHANGELOG entry to mention that
`ActionController::Parameters` will not inheriting from
`HashWithIndifferentAccess` in the next major version.
Add missing `Hash` methods to `AC::Parameters`

This is to make sure that `permitted` status is maintained on the
resulting object.

I found these methods that needs to be redefined by looking for
`self.class.new` in the code.

* extract!
* transform_keys
* transform_values
Refactor code to reduce duplicate `self.class.new`
Seperate Parameters accessors and mutators tests
Fix failing test on several methods on Parameter

* `each`
* `each_pair`
* `delete`
* `select!`
User `#to_hash` instead of calling `super`

Ruby 1.9.3 does not implement Hash#to_h, so we can't call `super` on it.
Improve custom configuration

1. Hashes can be assigned
2. We don't need a special level anymore

The method chain only works in the top level.

If users need a second level they need to assign a OrderedOptions to the
key:

    config.resque.server = ActiveSupport::OrderedOptions.new
    config.resque.server.url = "http://localhost"
    config.resque.server.port = 3000

[Rafael Mendonça França + Carlos Antonio da Silva]
Add default .raise_in_transactional_callbacks option to template
Move TimeHelperTest to TimeTravelTest from `as/test_test.rb`
Merge pull request #16299 from sikachu/ps-safer-ac-params

Update `ActionController::Parameters` to be more secure on parameters handling
Protect against error when parsing parameters with Bad Request

Related with #11795.
Merge pull request #16536 from rails/improve-custom-configuration

Improve custom configuration
Merge pull request #16349 from jmcnevin/master

Correctly determine if migration is needed.
loofah require dependecy is not needed anymore
Merge pull request #16563 from arthurnn/add_ar_raise_trans_option

Add default .raise_in_transactional_callbacks option to template
Fix the rails-dom-testing dependecy
Merge pull request #16564 from zzak/move_time_travel_test

Move TimeHelperTest to TimeTravelTest from `as/test_test.rb`
Bump ActiveJob's GlobalID dep to 0.2.3+ to fix Railties tests
Use released rails-deprecated_sanitizer