[#17176][release 3.0][real fix CVE-2014-7819] use 2.2.3 based sprockets

https://community.openproject.org/work_packages/17176

https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY
> Fixed Versions:     3.0.0.beta.3, 2.12.3, 2.11.3, 2.10.2, 2.9.4, 2.8.3, 2.7.1, 2.5.1, 2.4.6, 2.3.3, 2.2.3, 2.1.4, 2.0.5