- The sanitizer has been changed to safe_list_sanitizer.
- deprecate white_list_sanitizer

Fix unexpected select_tag delete behavior when include_blank is present

Need to new line to break line in the markdown.

* add leading `#` before `=>` since hash rocket is valid Ruby code
* add backticks
* remove trailing spaces
* and more

* Update RAILS_VERSION
* Bundle
* rake update_versions
* rake changelog:header

Revert "Remove finalizer and configuration"

This reverts commit 9e7b4a3173788ea43b11e74a4d2f69a5f1565daa.

https://github.com/rails/rails/blob/v6.0.0.beta1/actionview/CHANGELOG.md

[ci skip]

The `#csrf_meta_tags` and `#token_tag` Action View helper methods are
expecting the class in which are included to explicitly define the
method `#protect_against_forgery?` or else they will fail with
`NoMethodError`.

This is a problem if you want to use Action View outside of Rails
applications. For example, in #34788 I used the `#button_to` helper
inside of the error pages templates that have a custom
`ActionView::Base` subclass, which did not defined
`#protect_against_forgery?` and trying to call the button failed.

I had to dig inside of Action View to find-out what's was going on. I
think we should either set a default method implementation in the
helpers or check for the method definition, but don't explicitly require
the presence of `#protect_against_forgery?` in every `ActionViews::Base`
subclass as the errors are hard to figure out.

Generally followed the pattern for https://github.com/rails/rails/pull/32034

* Removes needless CI configs for 2.4
* Targets 2.5 in rubocop
* Updates existing CHANGELOG entries for fewer merge conflicts
* Removes Hash#slice extension as that's inlined on Ruby 2.5.
* Removes the need for send on define_method in MethodCallAssertions.

Firefox fires click events on left-, right-
and scroll-wheel (any non-primary mouse key) clicks while other browsers don't.

side of long lines; Fixes #34487

And remove trailing spaces.

This PR adds the allocations to the instrumentation for template and
partial rendering.

Before:

```
  Rendering posts/new.html.erb within layouts/application
  Rendered posts/_form.html.erb (9.7ms)
  Rendered posts/new.html.erb within layouts/application (10.9ms)
Completed 200 OK in 902ms (Views: 890.8ms | ActiveRecord: 0.8ms)
```

After:

```
  Rendering posts/new.html.erb within layouts/application
  Rendered posts/_form.html.erb (Duration: 7.1ms | Allocations: 6004)
  Rendered posts/new.html.erb within layouts/application (Duration: 8.3ms | Allocations: 6654)
Completed 200 OK in 858ms (Views: 848.4ms | ActiveRecord: 0.4ms | Allocations: 1539564)
```

The url_for method is now extracting the path_only option in order to determine if polymorphic_path or polymorphic_url should be called.

If the path_only option is not set it will be set to true unless the host option is set. This behaviour is the same as when a Hash or Params object is passed.

To support this unifying the code responsible for setting this default value has been extracted into a private method

Fixing code block rendering, indentation, backticks, etc.

Instead of dropping it completely in case someone is relying (probably
inadvertenly) on it.