Merge pull request #13341 from carlosantoniodasilva/ca-i18n

Default I18n.enforce_available_locales to true

We will default this option to true from now on to ensure users properly handle their list of available locales whenever necessary. This option was added as a security measure and thus Rails will follow it defaulting to secure option.

Also improve the handling of I18n config options in its railtie, taking the new enforce_available_locales option into account, by setting it as the last one in the process. This ensures no other configuration will trigger a deprecation warning due to that setting.
Some assorted fixes for the 4.1 release notes:

* Added release notes for secrets.yml and mentioned it in the highlights
* Added release notes for Mailer previews and mentioned it in the highlights
* Added release notes for Module#concerning
* Removed mention for AV extraction from the highlights
* Rearranged the major features to put highlighted features first
* Various improvements and typo fixes

[ci skip]
Merge pull request #13346 from chancancode/release_notes_etc

Release notes fixes [ci skip]
Add changelog entries about secrets.yml and secrets.secret_key_base
Merge pull request #13314 from laurocaetano/blacklist_array_methods

Create a blacklist to disallow mutator methods to be delegated to Array

Conflicts:
	guides/source/upgrading_ruby_on_rails.md
CSRF protection from cross-origin <script> tags

Thanks to @homakov for sounding the alarm about JSONP-style data leaking
Merge pull request #13345 from jeremy/get-csrf

CSRF protection from cross-origin <script> tags
Fix integration test to pass same-origin verification
Discuss Action Pack's new CSRF protection from remote script tags and what it means for your app. In short, update your tests if they don't already use the 'xhr :post' style.
Mention new CSRF protection gotcha in upgrade guide
Clearly limit new CSRF protection to GET requests
Remove the navigator for now. Its ugly and it promises more than it can deliver. These other views (properties, routes) are not designed to be loaded in isolation
Get ready to release 4.1.0.beta1
Fix dependency order
Its beta1 all around
[ci skip] Prettify the removals from Action Controller in 4.1 release notes.
Merge pull request #13358 from JuanitoFatas/patch/release-notes

Prettify the removals from Action Controller in 4.1 release notes. [ci skip]
Add a failing test for assigning nil to a polymorphic belongs_to not nullifying its _type column
#none documentation updated [ci skip]
allow video_tag to accept `size` as `Number` for square shaped videos