[Closes #16] Explicit deps in gemspec; tidy Gemfile.

CarrierWave depends on ActiveModel and ActiveSupport >= 3.2.0 (and not
ActiveRecord at all); so declare our own ActiveRecord dependency but
pin it < 4.0 in case there are breaking changes.