[issue-544] - Add filename and line number to CVE warnings in report

This adds ```:file``` and ```:line``` keys in the warning hash for warnings relating to libraries (Gemfile/Gemfile.lock).

Some notes:
* In testing, I had to regenerate the ```:fingerprint``` as it was generated using a different ```relative_path``` and as such didn't match in the tests. (e.g. ```Gemfile``` vs ```Gemfile.lock```).

@presidentbeef, hopefully this addresses the changes we wanted relating to #544. :chicken: 
It basically only comes up if there is no Gemfile.lock and the Gemfile contains something like `gem 'rails'` with no version. Somewhat rare.