Fix #4867: random=true in api only returns one post.

Pundit 2.1.1 changed it so that if the first argument to `authorize` is
an Array, then the `authorize` call returns the last element of the
array. This broke order:random, because in that case we returned an
Array of posts. The fix is to return an ActiveRecord::Relation of posts,
which is more correct anyway.

test/functional/posts_controller_test.rb

@@ -322,6 +322,15 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
           get posts_path, params: { random: "1" }
           assert_response :success
         end
+
+        should "return all posts for a .json response" do
+          create_list(:post, 2, tag_string: "honk_honk")
+          get posts_path, params: { tags: "honk_honk order:random" }, as: :json
+
+          assert_response :success
+          assert_equal(true, response.parsed_body.is_a?(Array))
+          assert_equal(2, response.parsed_body.size)
+        end
       end
 
       context "with the .atom format" do