Pin our dev dependencies

Runtime dependencies of gems should generally be somewhat loose to avoid
dependency hell in other gems and apps making use of them. Development
dependencies however are not affected by this concern, and should be pinned per
our styleguide. It also makes dependency resolution and documentation-finding
faster.
Fix never-ending dependency resolution on CI

CI deletes any Gemfile.lock and generates a new one. Something changed - likely
the release of Rack 1.5.0 on the day the problem started - and meant that the
dependency resolution never completed (it was always aborted after several hours).

No particular rationale for >=1.0.0, it's just the first thing that worked.