Disable CSP by default

Before this patch, to be able to use webpacker and webconsole we were
defining an used default in the script-src policy. White we don't
implement the automatic nonce approach defined in
https://github.com/rails/rails/issues/31689 it is better to not have any
default configuration in Rails 5.2.

Add ContentSecurityPolicy to list of middleware

Document in the guides the new middleware added in #31162
[ci skip]

Update rails-ujs readme

Allow @ in X-Request-Id header

yarnpkg: correct exec syntax

It is not a test case.

It makes sense to be as strict as possible
with headers from the outside world,
but allowing @ to support Apache's mod_unique_id
(see #31644) seems OK to me

Link to W3C reference was broken, this uses the latest URL, along with HTTPS.

Dump correctly index nulls order for PostgreSQL

Avoid extra calls to to_s

ActionController::TestCase: fix #post documentation

Fixes #31823.

This can not expand an array of aggregated objects correctly, and is no
longer used internally since 159b21b5.

With #31615 `type_for_attribute` accepts either
a symbol as well as a string. `has_attribute?` and `attribute_alias`
also accept either. Since these methods call `to_s` on the argument,
we no longer need to do that at the call site.

This suppresses `Timeout::Error` exceptions.
Ref: https://travis-ci.org/rails/rails/jobs/334622442#L1089-L1110

This example was added in abdf546a
but was inconsistent with `composed_of :balance` definition in the
'Customer'.

[Ryuta Kamizono & bogdanvlviv]

[ci skip]

This reverts commit 755f7b58, reversing
changes made to 35db4603.

Originally `mapping: %w(balance amount)` is correct mapping example.

Closes #31346.

[Ryuta Kamizono & bogdanvlviv]

[ci skip]

Allow type_for_attribute(:symbol)

Added tests for ActiveStorage::Blob#image? and ActiveStorage::Blob#video?

Follow up of #31724.

If `composed_of` objects have multiple mappings, array predicate handler
can not correctly handle the expanded condition.

We need to handle it like polymorphic association objects.

Remove joke in security guide [ci skip]

I think this is a joke, although not a great one.
It's mildly unprofessional, so I think we
should get rid of it.

Fix not expanded problem when passing an Array object as argument to the where method using composed_of column.

Define `supports_foreign_tables?` in AbstractAdapter

Remove out-of-date references to jQuery [ci skip]

Fixes #31703

This was changed with 5d7b70f4 and 428939be.

Because we use `credentials` in an example of configuration files, but
`credentials` can not be used unless it is 1.8.0 or later.

Ref: 9d65ac30