This reverts commit 224eddfc, reversing
changes made to 9d681fc7.

When merging the pull request, I misunderstood `has_secure_token` as declaring a model
has a token from birth and through the rest of its lifetime.

Therefore, supporting conditional creation doesn't make sense. You should never mark a
model as having a secure token if there's a time when it shouldn't have it on creation.

`substitute_at` is no longer used

The code that set the from clause was removed in
bdc51416. I did not give any reason for
doing so. My assumption was that I intended to change it to use the
clause objects, but forgot. We appeared to not have test coverage for
this case.

Fixes #22996

The code was changed to call `where` on a specific class in 813c8c07,
but no reasoning was given and I can't see any good reason why we would
need to do that. This will ensure that the method is called on whatever
class the scope is called on.

Fixes #23013

Set environment even when no migration runs

update doc for << method of has_many association

[ci skip] fix typo in docs

Fix typo in docs [ci skip]

Converting nbsp(\u{00A0}) to the normal ASCII space(\u{0020})
[ci skip]

Arel handles substitution for bind parameters by now.

Closes #22584.

Improve error message for #or when it is structurally incompatible

When you are using scopes and you chaining these scopes it is hard to
know which are the values that are incompatible. This way you can read
the message and know for which values you need to look for.

[Herminio Torres]

This reverts commit 5d41cb3b.

This implementation does not properly handle cases involving predicates
which are not associated with a bind param. I have the fix in mind, but
don't have time to implement just yet. It will be more similar to #22823
than not.

Empty strings / data structures should be treated differently than nils.
We don't really need these calls here (don't pass in blank strings).

Instead of checking whether the class has recycle! or not, we can just
always add the method to all controller classes when the test harness is
loaded.  Technically this means that the controller test harness will
not work with controllers that do not inherit from AC::Metal, but then,
I'm not sure that is supported anyway.

Mixing in the module one will ensure that we don't break method caches,
and eliminates a runtime check so it should speed up tests (slightly).

Add HTTP status name to output of tests

Prevent static middleware from attempting to serve a request with a null byte

While the predicates are an arel equality node where the left side is a
full arel attribute, the binds just have the name of the column and
nothing else. This means that while splitting the predicates can include
the table as a factor, the binds cannot. It's entirely possible that we
might be able to have the bind params carry a bit more information (I
don't believe the name is used for anything but logging), and that is
probably a worthwhile change to make in the future.

However the simplest (and likely slightly faster) solution is to simply
use the indices of the conflicts in both cases. This means that we only
have to compute the collision space once, instead of twice even though
we're doing an additional array iteration. Regardless, this method isn't
a performance hotspot.

Close #22823.

[Ben Woosley & Sean Griffin]

Also, refactor logic to convert between symbol and response code,
via the AssertionResponse class

AC::Parameters#at_json: restore Rails 4.2’s value

File paths cannot contain null byte characters and methods that do path
operations such as Rack::Utils#clean_path_info will raise unwanted
errors.

Fixes #23026

See discussion at #23026

Closes #23027.

This does not restore complete backwards compatibility. It simply passes
the contets of the `TEST` env to the new runner.

Closes #23021.

Make default scopes + STI happy again

Commit before freezing the headers

This shouldn't generally come up: under a standard flow, we don't start
sending until after the commit. But application code always finds a way.

Add a note on ActionController guide about 404

[ci skip]

Allow manually setting environment value

Given a default_scope on a parent of the current class, where that
parent is not the base class, the parent's STI condition would become
attached to the evaluated default scope, and then override the child's
own STI condition.

Instead, we can treat the STI condition as though it is a default scope,
and skip it in this situation: the scope will be merged into the base
relation, which already contains the correct STI condition.

Fixes #22426.

While the commit message (and changelog example) in
5e0b555b talked about sibling classes,
the added test had a child ignore its parent's scoping, which seems less
reasonable.