chore: upgrade dependencies to latest stable versions

[nejdetkadir]

Summary

Resolves the open Dependabot alerts (the "Security and quality" backlog) by moving the development/test dependency tree off the Rails 7.0.4-era Gemfile.lock. The gemspec's runtime constraints for host apps are unchanged (Ruby >= 2.7, Rails >= 6.0, devise >= 4.7.2).

Dependency changes

• Rails 7.0.4 → 8.1.3.1 — pulls in patched rack 3.2.7, nokogiri 1.19.4, loofah 2.25.2, rails-html-sanitizer 1.7.1, websocket-driver 0.8.2; rexml and net-imap advisories cleared with the new tree
• devise 4.8.1 → 5.0.4, bcrypt 3.1.22, concurrent-ruby 1.3.8
• puma ~> 5.0 → ~> 7.0, >= 7.2.1 (7.2.1), sqlite3 ~> 1.4 → ~> 2.0 (2.9.6) — old pins were blocking the patched versions
• rspec-rails ~> 6.0 → ~> 8.0, rubocop 1.42 → 1.90 (3 layout autocorrections in dummy-app initializers)
• added ostruct to the Gemfile (no longer a default gem since Ruby 3.5; needed on Ruby 4.0)

Other changes

• Dummy app bumped to config.load_defaults 8.1 so the suite exercises current framework defaults
• CI matrix updated from Ruby 2.7.7 / 3.0.5 / 3.1.3 / 3.2.0 to 3.2 / 3.3 / 3.4 / 4.0 (Rails 8 requires Ruby >= 3.2, so the old rubies can no longer install the lockfile); actions/checkout bumped to v4
• Docs (docs/development.md, docs/testing.md, docs/architecture.md) updated to match

Test plan

• bundle exec rake on Ruby 3.2.6 — 321 examples, 0 failures, 100% line + branch coverage, rubocop clean
• bundle exec rake on Ruby 4.0.3 — same result
• CI green across the new matrix

🤖 Generated with Claude Code