active_record: Type cast booleans and durations for string columns.

@rafaelfranca, @sgrif, @arthurnn this is a basically a rebase of pull #14894 which was closed without the problem being completely fixed.

## Problem

Pull #16037 partially fixed the problem is described in [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) by quoting Numeric types, however, that pull request missing the need to quote boolean and ActiveSupport::Duration types.

For example:

```ruby
User.where(:login_token=>params[:token]).first
```
can be exploited by passing in `false` for `params[:token]` through a JSON body causing the query
```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```
to match any login_token that starts with a non-digit character.

Quoting for these additional types was properly handled in mistakenly closed pull request #14894.

## Solution

ActiveRecord::Type::String#type_cast_for_database has been updated to handle these types.  Tests are included for these missed types as well as the numeric types which are already quoted properly to prevent regressions.
Yup, I initially added the `.to_s` before unpack was called in ActiveRecord::Type::Binary::Data#hex so that I could test binary columns, but updated this pull request to call `.to_s` in the ActiveRecord::Type::Binary::Data constructor instead to fix this vulnerability that this test uncovered in the mysql adapter.  I think the difference is that the mysql adapter uses type casting without quoting, so was skipping the hex method which was called for quoting.