Bump rails

@celsodantas @kmcphillips for review.

We want to bump `actionpack` for security.