Pin `select2-rails` to a specific version.

We shouldn't include dependencies on a third-party GitHub repo without
locking it down to a specific tag or commit. Besides, there's a released
gem available.

This is the closest version after the commit in `Gemfile.lock`. Because
the maintainer doesn't follow SemVer, we need to pin this to a single
version.
Version the `rummageable` dependency.

We shouldn't be depending on the `master` branch of a dependency,
because that can introduce backwards-incompatible changes. The commit
from `Gemfile.lock` is the release commit for version `1.0.1`, so we'll
use that as a minimum; because we're using SemVer, we only need to
restrict the version number to `1.x` to avoid backwards-incompatible
changes.
Pin down the `simple_form` dependency.

We should depend on released gems when possible, or at least a specific
tag or commit. This release candidate is the closest version after
the commit that was in `Gemfile.lock`. To compare the versions, see
<https://github.com/plataformatec/simple_form/compare/92a6a9...v3.1.0.rc1>
Merge pull request #157 from alphagov/pin-dependencies

Remove GitHub-based dependencies