core: Allow insecure RubyGems for plugins [GH-3610]