use Gemfile to track dependencies

this way a new person can just run `bundle install` and fetch all appropriate dependencies