Support gem.deps.rb lockfiles without sources

A lockfile can omit a source which defaults to rubygems.org.  Now
RubyGems handles such lockfiles correctly.  Unlike bundler, RubyGems
defaults to HTTPS (bundler defaults to HTTP).

Fixes #820