Upgrade critical dependencies

[grega]

This application is running software that is considered to be out of date (eg. no security support):

• Puma: should be >=7.2
• Rails: should be >=8.1
• Ruby: should be >=3.3

See: https://digital-ops-dashboard.rpf-internal.org/dependency-report

[patch0]

These are all development dependencies, and don't end up in the final library.

[grega]

Thanks @patch0. I think there are a few options here:

1. We upgrade development dependencies when flagged as out-of-date anyway, since there's a benefit to keeping tooling up-to-date (probably?), but not that this is a preference rather than a security-related requirement
2. We don't upgrade development dependencies when flagged as out-of-date, and update the dependency report to not flag repositories where these high-value dependencies are development-only (though, that will become complex where repos contain both dev and non-dev requirements that will need to be conditionally flagged...)
3. We don't upgrade development dependencies when flagged as out-of-date, and do nothing else, and simply comment on and close issues as "not needed" in future (like this one)

Or something else I'm missing?