Lock all Dependencies in metadata.rb

...because gitlab is an application cookbook and we want to ensure that it always installs with the same dependencies.

The `Berksfile.lock` would have been sufficient for installing the correct dependencies via berkshelf, but Chef only honors the dependencies defined in `metadata.rb`, not the Berksfile.

For Chef Solo this is less of an issue (vagrant just uploads whatever berkshelf has resolved), but if we want to use the gitlab application cookbook on Chef Server then we **MUST** to put the dependency version constraints into the `metadata.rb`.