The `ActionDispatch::Session::MemcacheStore` is still vulnerable
given it requires the gem dalli to be updated as well.

CVE-2019-16782

* Bump RAILS_VERSION
* Bundle
* rake update_versions
* rake changelog:header

Allow using combine the Cache-Control `public` and `no-cache` headers

Restore an ability that class level `update` without giving ids

Allow nil params on controller HTTP test methods

Reset Capybara sessions if failed system test screenshot raising an exception

There is no controller instance when using a redirect route or a
mounted rack application so pass the request object as the context
when resolving dynamic CSP sources in this scenario.

Fixes #34200.

(cherry picked from commit a150a026)

Previously if a dynamic source returned a symbol such as :self it
would be converted to a string implicity, e.g:

  policy.default_src -> { :self }

would generate the header:

  Content-Security-Policy: default-src self

and now it generates:

  Content-Security-Policy: default-src 'self'

(cherry picked from commit ed91b75c)

Prevent `RequestEncoder#encode_params` to parse falsey params

- Add missing dot.
- warp code example in "```".

[ci skip]

Fixes StrongParameters `permit!` to work with nested arrays

Fix reference to fixed issue in actionpack/CHANGELOG.md

[ci skip]

Output only one nonce in CSP header per request

Only disable headless chrome gpu on Windows

* Check exclude before flagging cookies as secure.

* Update comments in ActionDispatch::SSL.

[Catherine Khuu + Rafael Mendonça França]

- Add missing dots.
- Change example of using `content_security_policy_report_only`
  in controller.
- Remove TODO.

Related to #32222

If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.

e.g:

    class LegacyPagesController < ApplicationController
      content_security_policy false, only: :index
    end

Consistent behavior for session and cookies with to_h and to_hash method

- Update the default HSTS max-age value to 31536000 seconds (1 year)
  to meet the minimum max-age requirement for https://hstspreload.org/.

Add support for automatic nonce generation for Rails UJS

[ci skip]