Move MappingsProgress into a controller concerns directory

This is the idiomatic place for concerns to live (especially as of
Rails 4) so seems sensible, even though we're not using ActiveSupport::Concern
which would generally be used by concerns which live here.

Having this code in app/ rather than lib/ also means that the dev server
reloads it for us.
Move CheckUserCanEditMappings into app/controllers/concerns/
Convert CheckUserCanEditMappings to our concerns style

This means that we can use it by only calling a method, without
having to include the module explicitly in the controller as well.
Add DisableColumns as a concern

Functionality is the same as it was before, which isn't perfect...

This currently only works when instantiating a new object; fetching
one from the database and then trying to access the disabled columns
doesn't raise an error.

The error raised by ImportBatch.new.type is actually
ActiveModel::MissingAttributeError and not NoMethodError - the test
asserting that NoMethodError should be raised was still passing,
presumably because MissingAttributeError inherits from NoMethodError,
but I've made the test more specific for accuracy.

However, ImportBatch.new.foo *does* raise NoMethodError, so it is
still treating the disabled columns differently from ones which
don't exist in the database.
Also disable columns when fetching from the database
Only use after_initialize to disable columns

Both tests pass without overriding columns(). The only thing I can
find which behaves differently is that when:

- setting a disabled attribute
- saving it
- reloading the object

...when columns() is overridden the column doesn't show up on reload,
and when it isn't overridden the column does appear. In both cases the
attribute can be read after reloading, unsurprisingly.

Since this seems like an edge case and doesn't actually prevent anyone
using the disabled columns either way (which is presumably what we're
trying to do here), let's do less and stop overriding columns() as well.
Rename MappingsProgress module to match filename

Even though we're not relying on autoload here (because these aren't
'real' concerns) it's less confusing to stick to this convention.
Call disable_columns with an implied array of symbols

This is a bit more Railsy.
Merge pull request #354 from alphagov/controller_concerns

Controller and model concerns
Update all of the gems so that Rails 4 works

- I've probably missed some, but there'll be further updates as I go
  through every error that now exists.
- Rails 4 deprecates the :assets group within the Gemfile.
Fix some errors that came before any red tests

- Not entirely sure what these change, but I've done what the error
  output told me to do to fix the error:

  - Eager load the application only in production.
  - Remove the mass-assignment protection and the whitelist attributes
    ActiveRecord setting - this is done by strong_parameters in Rails 4.
  - Remove the unused ActiveResource config line.
Specify which HTTP methods to call on each route specified by match

- Using match on its own is deprecated.
Make RSpec render_views work again by including a new config line
Require 'rspec/expectations' and 'rspec/mocks' in spec_helper.rb
Remove deprecated specifying of which error is being raised
Remove the deprecated config.whiny_nils in dev and test
Use the new Rails 4.0 syntax for scopes
The use of stub (in some cases?) is deprecated - use double instead
Make controllers use strong parameters

- Versions, mappings, whitelisted_hosts, organisations, hits, sites,
  mappings_batch.
Add config.secret_key_base to secret_token.rb

- Rails 4 needs this, apparently. Corresponding PR opened:
  https://github.gds/gds/alphagov-deployment/pull/633, which will
  replace 'overwritten' with an actual key. Is this fine as
  'overwritten'?