bump rails3 for security fix

Change-Id: Iaa403bbcea1aeb453bded5c068c0eb3b15bfcae0
Reviewed-on: https://gerrit.instructure.com/37320
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>