(FACT-567) Restore Windows gem package dependencies

The gem packaging (rake package:gem) and the bundler (bundle install)
workflows can be driven by the same ext/project_data.yaml file for
simple use cases like the CFPropertyList gem on darwin.

However, it doesn't work for Windows gem dependencies across different
ruby versions (ruby 1.9 x86 and ruby 2.0 x64) and windows architectures
(x86 and x64).

For example, the following will fail on ruby 1.9 x86:

    platform(:mingw, :x64_mingw) do
      gem 'ffi'
    end

Because only bundler version 1.5.0 and up understand the `:x64_mingw`
platform[1]. Running with an earlier version of bundler will fail
hard with '`x64_mingw` is not a valid platform.'

Another issue is that the current packaging workflow assumes the same
gem, e.g. `ffi`, isn't expressed across multiple platforms, e.g.
x86-mingw and x64-mingw. If you do this in project_data.yaml, then
during a `bundle install` we effectively end up doing:

    platform(:mingw) do
      gem 'ffi'
    end
    platform(:x64_mingw) do
      gem 'ffi'
    end

which results in warnings like:

    Your Gemfile lists the gem ffi (~> 1.9.3) more than once.
    You should probably keep only one of them.  While it's not
    a problem now, it could cause errors if you change the
    version of just one of them later.

Alternatively, you can do `gem 'ffi', :platforms => :mingw, :x64_mingw`,
but the project_data.yaml file is not setup to express dependencies like
that.

Commit 72f820d01 moved windows dependencies from project_data back to
the Gemfile. As a result, windows specific facter gems did not contain
any dependency info. So doing a `bundle install` on code that depends on
facter, would not include the transitive windows gem dependencies, e.g.
ffi.

This commit duplicates the windows gem dependencies in the
project_data.yaml. Also when using bundler on windows, we only pull in
dependencies from the Gemfile, but not project_data.yaml. Otherwise, we
would get the 'Your Gemfile lists the gem ... more than once' error on
all platforms.

As a result of this change, we need to keep the dependencies in the
Gemfile and project_data.yaml in sync. At a future date, we can look at
improving the packaging repository to handle more complex gem
dependencies.

[1] https://github.com/bundler/bundler/commit/facdbf0a962
(maint) Bump win32-security to at least 0.2.5

Versions of win32-security prior to 0.2.5 contained a bug on x64 due to
ulong being a 32-bit unsigned integer, whereas the OpenProcessToken method
takes a uintptr_t, which is 64-bit unsigned integer[1]

[1] https://github.com/djberg96/win32-security/commit/4af3625d61