fix serialization vulnerability
fixing attr_protected CVE-2013-0276
Fix for CVE-2013-0155
Re-write gemspec without rake FileList

FileList is the only thing that required us to have rake.
I've attempted to remove it and replace it with equivalent Dir commands.

The reason to remove rake is that deploys to new sites were failing when we
used our github version of rails.

The problem being that bundle always fetches a github repo-gem before all
other gems... including, say, rake.
So when this gemspec was loaded - rake didn't exist in the bundled (empty)
gemset... but the gemspec relies on it... thus we got "no such file to load
-- rake" over and over with no way to win.

Our previous sites deployed beause they'd been bundled *before* we added the
github version of rails - and so they alreayd had some gems (including rake)
bundled - and wre just getting updated, rather than new-installed.