Add delegation constants to Module

* Update RAILS_VERSION
* bundle (with Ruby 2.6)
* rake changelog:header

[CVE-2020-8163]

* Update RAILS_VERSION
* Bundle
* rake version
* rake changelog:header

[CVE-2019-5418]
[CVE-2019-5419]

Trusting any GlobaID object when deserializing jobs can allow
attackers to access information that should not be accessible to them.

Fix CVE-2018-16476.

The queue_classic gem before version 3.1.0 was locked to patch releases
of the pg gem so bump the version up from 0.3.2 - unsure how this ever
worked with 0.3.2 as QC::Setup module didn't exist until version 2.0.0.

Even with using queue_classic-3.1.0 it still has an upper bound of < 0.19.0
so we need to reduce our pg upper bound so that bundler will resolve.

Rails 4.2 will never be compatible with pg-1.0 or later so no need
to be warned about constants being removed and also prevent weird
bundler resolution with early queue_classic and pg-1.1.3.

Up to `2.7.0`, encoding was chosen using `Mail::Encodings::TransferEncoding.negotiate`,
and base64 encoding was used.
In `2.7.1`, when `transfer_encoding` is not specified, the encoding
of the message is respected.
Related to: https://github.com/mikel/mail/commit/dead487e02f592d9058fd07deedcde39b569d18d

However, what chosen for transfer encoding is not essential in these tests.
To test more accurately, confirm that the decoded body instead.

(cherry picked from commit d2d6f6b7)

Sidekiq 5.1.3 fixes the version check on Ruby 2.2.10.

Sidekiq has a version check error for Ruby 2.2.10.

Later versions of rubygems require YAML safe loading but they
aren't available in Ruby 1.9.3 and 2.0.

Rake versions starting from 12.3.0 require Ruby 2.0.0 or newer.

Later versions require Ruby 2.0.0 or newer.

The removal of path separators from the tmpname value affects all four
supported versions of Ruby - 2.2.10, 2.3.7, 2.4.4, and 2.5.1.

See flavorjones/loofah#144

https://github.com/rails/rails/commit/505537082849d912e8e29819655b80a573e93c0c
added a call to `remove_possible_method`, but didn't require the file
that defines it.

(cherry picked from commit 001fc80d)

turbolinks 5.1 doesn't work in ruby < 2.1

Bunlder 1.16.1 is causing Railties tests to fail for Rails 4-2-stable
branch. Avoid installing it for now so we can run those tests.

Newer versions of resque-scheduler use the new hash syntax which means
they won't work with Ruby 1.9.3.

This commit locks resque-scheduler to an older version when we're using
less than Ruby 2.0.0

Fixes:

```
def evalsha(script, keys, argv, refresh: false)
                                        ^
/home/travis/build/rails/rails/vendor/bundle/ruby/1.9.1/gems/resque-scheduler-4.3.1/lib/resque/scheduler/lock/resilient.rb:78: syntax error, unexpected keyword_end, expecting $end
```

Somehow travis installed queue classic 0.3.2. 0.3.2 causes the following
error:

```
1) Error:
AdapterTest#test_perform_job_logging:
URI::InvalidURIError: bad URI(is not URI?):
```

This change sets the lock file to install above 0.3.2. I'm not sure what
folks are using in production but this prevents the oldest version like
that from being installed on travis.

Ruby gems 2.7.3 causes the following error in Railties tests on Ruby
1.9.3 and 2.0.0:

```
1) Failure:
ApplicationTests::BinSetupTest#test_bin_setup_output
[test/application/bin_setup_test.rb:48]:
--- expected
+++ actual
@@ -1,4 +1,5 @@
"== Installing dependencies ==
+YAML safe loading is not available. Please upgrade psych to a
version that supports safe loading (>= 2.0).
The Gemfile's dependencies are satisfied
```

I'm not aware of a way to make travis set different ruby gems versions
for specific ruby versions. I really don't think it matters too much
since this is just on travis and we're not releasing Rails 4.2 much
anymore. I want to maintain a green build though.

Uglifier 4.0.1 doesn't work without Sprockets 3.7.1. Since 4.2 isn't
really getting updates we should try to at least maintain a green build.

Fixes the following errors:

Build ref: https://travis-ci.org/rails/rails/jobs/313152105#L777
Build ref: https://travis-ci.org/rails/rails/jobs/313152105#L772

An update to mail broke some tests on Rails. Originally they were
unblocked here #31026 but Jeremy fixed them for Mail 2.7 in
0931e17e.

I wasn't able to cleanly backport this so I'm doing it manually. Fixes
the failing Rails 4.2 build on travis.

https://travis-ci.org/rails/rails/jobs/279300966#L2600

The result of `Loofah::HTML5::Scrub.scrub_css` was changed since
v2.1.0.rc1.

https://github.com/flavorjones/loofah/commit/ca56295ff9e802018ea18d23ed49be235a95ccad

The new version has some minor issues, and old release branches
traditionally keep their theme anyway.