Add CHANGELOG entry for js responder security fix
No need to call gemspec in common_spree_dependencies

Each component Gemfile already calls it