Security release.
Fixes a reflected XSS and open redirect in sort_link and sort_url. Request
parameters were passed to url_for, so a crafted query string such as
?script_name=javascript:... could make every sort link on a page run script in
the application's origin or point to another site when clicked. Ransack now drops
url_for's URL options (script_name, host, protocol, only_path and others)
from the request params it carries into the link. Affects any page that renders a
sort link.
GHSA-58rx-96gf-w92x. Also released as 6.0.1 and 5.0.3.