Remove the use of String#% when formatting durations in log messages

This avoids potential format string vulnerabilities where user-provided
data is interpolated into the log message before String#% is called.

Conflicts:
	actionpack/lib/action_controller/log_subscriber.rb

Conflicts:
	actionpack/lib/action_controller/log_subscriber.rb

Signed-off-by: Neal Harris <neal@squareup.com>
Merge pull request #15 from square/neal/patch-CVE-2013-4389

Remove the use of String#% when formatting durations in log messages