use https sources in Gemfiles and also in the documentation (#4109)
include Gemfile.lock to prevent unintended updates (#4174)

We had a broken production server lately because it had upgraded the couchrest model dependency to one that had a different naming scheme for a function we overwrite. So that broke production.
Let's prevent that by including the Gemfile.lock in our repositories.
remove duplicate source line that was using http

I don't think we need to list the sources again in common_dependencies.rb
Merge pull request #105 from azul/feature/4109-https-sources

use https sources in Gemfiles and also in the documentation (#4109)