bump rails

the security fixes don't apply to Canvas, but it's good
to be on latest for the next update that we would need

Change-Id: If40afec856611340e73fa14b3c1b75e152850155
Reviewed-on: https://gerrit.instructure.com/44533
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>