Fix materialized deps

[RyanBrushett]

Motivation

The bundler materialized deps changed a bit more than we initially thought and the materialized dependencies still included the missing specs as it was.

This fixes that properly.

Implementation

• Filter the list of materialized deps so that missing_specs are rejected.
• Fix a skipped test that would have caught this issue. Thanks @paracycle for pointing that out! Fixes Shopify/sorbet-issues#330
• Change CI so we're passing the BUNDLER_VERSION env var. rather than the _version_ syntax.
• Exclude the support repo's Gemfile.lock again. Committing it means the tests will all run on the same bundler version, regardless of what is set by the env.
• Lock the versions of the things in the Gemfile that are sensitive to change. Given it's a test repo, no more surprises is good.

Tests

See automated tests.

[RyanBrushett]

If it makes backporting this to the 0-4-stable branch easier, I can split this up a little bit.

[paracycle]

If it makes backporting this to the 0-4-stable branch easier, I can split this up a little bit.

The current state is fine, shouldn't be a problem.