Use https when downloading Gems.

Dependencies should be using a secure channel to rubygems.