use Gemfile to track dependencies

this way a new person can just run `bundle install` and fetch all appropriate dependencies

You can later setup your project to expose executables such that they always resolve the correct dependencies, I totally forget how though. I think it's part of the bundler magic.