Merge branch 'master-sec'

* master-sec:
  Deep Munge the parameters for GET and POST
  Stop using i18n's built in HTML error handling.
  Ensure simple_format escapes its html attributes
  Escape the unit value provided to number_to_currency
  Only use valid mime type symbols as cache keys
Fix offset with last.

Closes #7441
Remove the escaping skip

We are generating safe strings in the paragraph, so we can escape the
tags
Merge pull request #13149 from laurocaetano/fix_offset_last

Fix offset with last.
Merge pull request #12462 from jjb/improve_ar_exception_message_formatting

Improve formatting of ActiveRecord migration exception messages
Improve AR changelog, add entry for migration error improvements #12462 [ci skip]
Change deep_munge call to avoid deprecation warning
Rename variable that holds whether or not the class should validate a float number
Refactor to avoid earlier returns
Stop using local variables everywhere, make use of the reader
Avoid a hash creation since defaults is a new hash already
No need for #tap
Remove useless empty string
Make both conversion methods work similarly

The conversion without area code already changed the passed number in
place, so change the other method to do the same.
Change delimiter check order: first check if it is present

This reads a lot better, and we won't need to try start_with? for blank
delimiters.

Also rename method name to read better.
Remove earlier return in favor of conditional
optimize string literals in erb templates
Install Spring preloader when generating new applications
Action Pack Variants

By default, variants in the templates will be picked up if a variant is set
and there's a match. The format will be:

  app/views/projects/show.html.erb
  app/views/projects/show.html+tablet.erb
  app/views/projects/show.html+phone.erb

If request.variant = :tablet is set, we'll automatically be rendering the
html+tablet template.

In the controller, we can also tailer to the variants with this syntax:

  class ProjectsController < ActionController::Base
    def show
      respond_to do |format|
        format.html do |html|
          @stars = @project.stars

          html.tablet { @notifications = @project.notifications }
          html.phone  { @chat_heads    = @project.chat_heads }
        end

        format.js
        format.atom
      end
    end
  end

The variant itself is nil by default, but can be set in before filters, like
so:

  class ApplicationController < ActionController::Base
    before_action do
      if request.user_agent =~ /iPad/
        request.variant = :tablet
      end
    end
  end

This is modeled loosely on custom mime types, but it's specifically not
intended to be used together. If you're going to make a custom mime type,
you don't need a variant. Variants are for variations on a single mime
types.
Add variants to release notes