At thoughtbot, we'd like to have a unified approach to security issues
within our projects. This dynamic workflow will update Clearance's
SECURITY.md with any changes made to SECURITY.md in the
thoughtbot/templates repo.

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Use Pathname.new in install_generator_spec

Fix DEPRECATION WARNING: The `exist` matcher overrides one built-in by RSpec; use `expect(Pathname.new(path)).to exist` instead

* Disable config.active_record.legacy_connection_handling

Fix DEPRECATION WARNING: Using legacy connection handling is deprecated. Please set `legacy_connection_handling` to `false` in your application.

* Add #get_migration helper

Using `Pathname.new` in tests results in a Hound error because of line length.

* Only use legacy_connection_handling false for Rails < 7.1

When using the 7.1 gemfile, we get this complaint:
"The `legacy_connection_handling` setter was deprecated in 7.0 and
removed in 7.1, but is still defined in your configuration. Please
remove this call as it no longer has any effect."

This change also sets legacy_connection_handling for Rails versions
before 7.1.

---------

Co-authored-by: Sara Jackson <csara@thoughtbot.com>

solves #993

added config option to disallow password reset routes in cases where its not needed.  allow_password_resets defaults to true but can be set to false in instances where it is not needed.