[issue-544] - Add filename and line number to CVE warnings in report

This addresses #544.

When warning on libraries, this PR adds either 'Gemfile' or 'Gemfile.lock' with the line number appended in the report. For example:
```
Rails 4.0.1 contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 4.0.2
```

With this PR, changes to:
```
Rails 4.0.1 (Gemfile:3) contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 4.0.2
```

I've tracked down usages of ```tracker.config[:gems]``` in an effort to modify the report message in all pertinent places, but definitely let me know if you know of any I've missed.
File should be Gemfile here, too.