Prefer HTTPS sources over HTTP sources

While RubyGems does not appear to contain any exploitable code similar
to that in the Rails + YAML exploit, using HTTPS over HTTP reduces the
chance of an MITM attack when installing gems.

https://rubygems.org is now the default source.

When adding a http://rubygems.org via `gem sources`, RubyGems now asks
for confirmation as https://rubygems.org is preferred.

Gem::DependencyResolver::APISet now uses https://rubygems.org and is
tested.

Credit to Alex Gaynor for pointing out the use of HTTP in
Gem::DependencyResolver::APISet.

RubyGems now attempts to transparently upgrade HTTP sources to HTTPS.