Merge pull request #16564 from zzak/move_time_travel_test

Move TimeHelperTest to TimeTravelTest from `as/test_test.rb`
Bump ActiveJob's GlobalID dep to 0.2.3+ to fix Railties tests
Use released rails-deprecated_sanitizer
Use released rails-html-sanitizer
Remove git dependecies
Add TODO note about the gems missing release
Move date and time requires to time_travel_test, also include
'abstract_unit'.

cc #16564
We always get the value so no need to check nil or Hash
[ci skip] Added documentation for belongs_to scope parameter
Mention web-console in 4.2 release notes

Mention the web-console inclusion in the default Gemfile in the Release
notes and the railties changelog. We can eventually mention it in the
upgrade guide, if needed.

[ci skip]
Merge pull request #16475 from tomkadwill/has_many_scope_documentation

[ci skip] Added documentation for belongs_to scope parameter
Merge pull request #16561 from gsamokovarov/mention-web-console-in-changelog

Mention web-console in 4.2 release notes
Require rack/utils
Auth token mask from breach-mitigation-rails gem

This merges in the code from the breach-mitigation-rails gem that masks
authenticity tokens on each request by XORing them with a random set of
bytes. The masking is used to make it impossible for an attacker to
steal a CSRF token from an SSL session by using techniques like the
BREACH attack.

The patch is pretty simple - I've copied over the [relevant
code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb)
and updated the tests to pass, mostly by adjusting stubs and mocks.
Revert "Improve custom configuration"

This reverts commit de4891344ccc074f6d5693f4fac6ad610584e336.

Conflicts:
	railties/lib/rails/railtie/configuration.rb

It added regression. Will be back after the beta
Require sprockets-rails 3.0.0.beta1
Use web-console 2.0.0.beta2 on new apps
Synced Active Model changelogs [ci skip]

Godfrey Chan, Genadi Samokovarov
Point to right sass-rails version
Fix setting simple values to the new config.x

Previously setting simple values to the config.x object resulted in the
following:

    config.x.super_debugger = true
    config.x.super_debugger #=> {}

Which was against the examples showed in the changelog/release notes.