Relax dependency on gds-sso

We're in the process of changing the format of permissions as they
are stored in applications and sent around by Signon.

gds-sso 3.0.0 expects the permissions attribute on the User to be
an Array, rather than a Hash. govuk_content_models hasn't been
upgraded yet to deal with this, but we need to upgrade gds-sso in
other apps that use govuk_content_models, but don't use it for the
User model. Without relaxing this dependency, that is impossible.
Release 3.0.1