Add Action Cable introduction to release notes

`{ internal: true }` from being stored in the router

Forgotten followup to #23669 😬

If you went to an internal route (e.g. `/rails/info/routes`), you would
previously see the following in your logger:

```bash
Processing by Rails::InfoController#routes as HTML
  Parameters: {"internal"=>true}
  Rendering /Users/jon/code/rails/rails/railties/lib/rails/templates/rails/info/routes.html.erb within layouts/application
  Rendered collection of /Users/jon/code/rails/rails/actionpack/lib/action_dispatch/middleware/templates/routes/_route.html.erb [2 times] (10.5ms)
  Rendered /Users/jon/code/rails/rails/actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb (2.5ms)
  Rendered /Users/jon/code/rails/rails/railties/lib/rails/templates/rails/info/routes.html.erb within layouts/application (23.5ms)
Completed 200 OK in 50ms (Views: 35.1ms | ActiveRecord: 0.0ms)
```

Now, with this change, you would see:

```bash
Processing by Rails::InfoController#routes as HTML
  Rendering /Users/jon/code/rails/rails/railties/lib/rails/templates/rails/info/routes.html.erb within layouts/application
  Rendered collection of /Users/jon/code/rails/rails/actionpack/lib/action_dispatch/middleware/templates/routes/_route.html.erb [2 times] (1.6ms)
  Rendered /Users/jon/code/rails/rails/actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb (10.2ms)
  Rendered /Users/jon/code/rails/rails/railties/lib/rails/templates/rails/info/routes.html.erb within layouts/application (17.4ms)
Completed 200 OK in 44ms (Views: 28.0ms | ActiveRecord: 0.0ms)
```

Fix API controller tests by assigning them the encoding type

reference actual class to use middleware

Was worried the `as` might impede on users doing the long form
JSON response encoding; test for certainty.

Use `#performed?` to terminate controller callbacks

This test was broken by f650e032. It was
added by https://github.com/rails/rails/pull/17978, and is adequately
tested elsewhere. The reason that this breaks is that
`Controller#process` is not going to set a new response object, and we
now terminate in callbacks if the response has been sent. The only
reason that this test was calling `get` in the first place was because
the controller under test blows up if `request` was `nil`. The point
being that the failure is invalid, and I don't think we need to fix the
test in this location.

- Fixes #25183.
- The `as: :json` feature was added in
  https://github.com/rails/rails/pull/21671 and recommended to use for
  JSON endpoints so let's use it by default for API controller tests.

Since Ruby 2.4 isn't out yet, the fact that it will make `to_time` preserve the
time zone should be toggled with a update flag.

Second, remove the flipping on what version had what defaults. It's called new
framework defaults, so it's from the future looking. Thus keep the line that
mentions past versions.

More cleanup of new framework defaults

Improve Hash#compact! documentation and tests

Do not suggest nonsensical OpenSSL verify modes 

Require Nokogiri >= 1.6.8

- Adjusted tests instead.

SSL_set_verify(3) explains:

SSL_VERIFY_FAIL_IF_NO_PEER_CERT
  Server mode: if the client did not return a certificate, the TLS/SSL
handshake is immediately terminated with a "handshake failure" alert.
This flag must
  be used together with SSL_VERIFY_PEER.

  Client mode: ignored

SSL_VERIFY_CLIENT_ONCE
  Server mode: only request a client certificate on the initial TLS/SSL
handshake. Do not ask for a client certificate again in case of a
renegotiation.
  This flag must be used together with SSL_VERIFY_PEER.

  Client mode: ignored

The SMTP connection here uses a OpenSSL socket in client mode,
suggesting invalid/ignored flags is rather misleading.

per security release today --> https://groups.google.com/forum/#!topic/ruby-security-ann/RCHyF5K9Lbc

Change doc for race_condition_ttl option of ActiveSupport::Cache::Sto… [ci skip]

Action Cable: Fix CI tests on Sauce Labs

Add backticks to `ActiveRecord::Base.where`

[ci skip] Update redirecting links in guides

The related option of this method, `expires_in` is documented
as expecting an `ActiveSupport::Duration` value. To minimize any sort of
ambiguity between duration options, this change also documents
`race_condition_ttl` accepting `ActiveSupport::Duration`.

Fix a typo in `time_field` [ci skip]

Added some useful configuration options into configuring.md [ci skip]

Trim Action Cable README [ci skip]

- Only Action Cable README did not have this section, all of the other
  READMEs have this section.

- Remove "Configuration", "Running the server", "Dependencies" and "Deployment"
  sections from the Action Cable README as they are already duplicated in the
  Action Cable overview guide.

[ci skip]

Update the documentation of new_framework_defaults file with more details about old apps and how you can upgrade to new defaults.

[Kasper Timm Hansen, Prathamesh Sonpatki]

Fix minor regression about old apps not getting per_form_csrf and request_forgery_protection configs

- Earlier per_form_csrf_tokens and request_forgery_protection config
  files were generated for old apps upgraded to Rails 5.
- But when we collapsed all initializers into one file, the entire file
  does not get created for old apps.
- This commit fixes it and also changes values for all new defaults for
  old apps so that they will not break.
- Also added a test for `rails app:update`.

- Move real new default options to the top of the file.
- After that club together all the options which were added to keep
  backward compatibility. So all of them will get only one header.
- Based on https://github.com/rails/rails/pull/25231#issuecomment-222945173.

[ci skip] Fix link rubyonrails.org/core => http://rubyonrails.org/community

[ci skip] Remove Pratik Naik from Rails core team info.