update rails to 3.2.20

This is a security fix against a file existence exposure CVE-2014-7819

see:
http://weblog.rubyonrails.org/2014/10/30/Rails_3_2_20_4_0_11_4_1_7_and_4_2_0_beta3_have_been_released/

Conflicts:
	Gemfile.lock
Fix sprockets file exposure vulnerability

There is an information leak vulnerability in Sprockets. This
vulnerability
has been assigned the CVE identifier CVE-2014-7819.

see:
https://groups.google.com/forum/#!topic/rubyonrails-security/wQBeGXqGs3E

The patch given in
https://15028051456732132684.googlegroups.com/attach/7887e1a7070ca526/2-12-sec-static-files.patch?part=0.0.1&view=1&vt=ANaJVrGrEs8fNpWjOUFuf3p1rWA83Dw-kPMJ8qeYExCi_n6nnuHcw53a2rWDfBwsfeA06s9Okm3LkpBK1W_b0vsqlsNAHGW1g0Z0T8WcmWxvqJCshdVpLts

Was manually applied to the backport branch.

This commit can be reverted as soon as sprockets 2.12.X is used.
Update README.md

changing feature and help links
Merge pull request #2118 from opf/hotfix/backport_rails_3_2_20

[release/3.0] Fix CVE-2014-7818 and CVE-2014-7819
Merge pull request #2141 from marutosi/finn/release/3.0/README.md

Update README.md
Update of sprockets gem to fix CVE-2014-7819

Commit also updates some other gems as well and
removes uber (bundle update was used).
Revert "Fix sprockets file exposure vulnerability"

This reverts commit 17c666c8dc39a482ca8afa6f3c3fb048ed6428a0.

The fix is not needed anymore if sprockets 2.2.3 is used.
Merge pull request #2147 from opf/hotfix/update_sprockets_version

Update sprockets version to address CVE-2014-7819
Bump version to 3.0.15
Bump version to 3.0.16
Test WP's spent hours property with read permission
Respect time entry view permission
Fix cuke
Merge pull request #2189 from opf/hotfix/3_17304_view_time_entries_permission_not_respected_on_wp_spent_hours

17304 view time entries permission not respected on wp spent hours
Really outdated net-ldap gem fails with Apache DS

The really outdated net-ldap gem fails with Apache DS.
See https://community.openproject.org/topics/1013.
Merge pull request #2208 from marutosi/finn/net-ldap-dependency/3.0

Really outdated net-ldap gem fails with Apache DS
update rails to 3.2.21
Merge pull request #2220 from opf/hotfix/release-3.0-rails-3.2.21

update rails to 3.2.21 (3.0 release)
[release/3.0] Getting ready for Teatro

https://github.com/opf/openproject/pull/1681
[release/3.0] attempt to fix teatro setup

It seems that the secret token env var was not persistent.
Now we generate the secret token as a file and things should be persistent.

https://github.com/opf/openproject/pull/1681