[#17176][release/4.0][real fix CVE-2014-7819] use 2.2.3 based sprockets

https://community.openproject.org/work_packages/17176

PR #2138 comment is wrong.

* https://github.com/tessi/sprockets/pull/1
* https://github.com/finnlabs/sprockets-rails/pull/1