gems: add brakeman for security checks
gems: don't require brakeman