update rubyzip to address CVE-2019-16892

[annaswims]

Description of change

Name: rubyzip
Version: 1.2.2
Advisory: CVE-2019-16892
Criticality: Unknown
URL: rubyzip/rubyzip#403
Title: Denial of Service in rubyzip ("zip bombs")
Solution: upgrade to >= 1.3.0

Testing done

Testing planned

Acceptance Criteria (Definition of Done)

Applies to all PRs

• Appropriate logging
• Swagger docs have been updated, if applicable
• Provide link to originating GitHub issue, or connected to it via ZenHub
• Does not contain any sensitive information (i.e. PII/credentials/internal URLs/etc., in logging, hardcoded, or in specs)
• Provide which alerts would indicate a problem with this functionality (if applicable)

[annaswims]

cc: @ATeal who introduced rubyzip in #3059

[johnpaulashenfelter]

This is pretty minor and seems straightforward to roll out.

Seems really weird that the maintainer of the gem release 1.3 and 2.0 with the same code: https://github.com/rubyzip/rubyzip/blob/v2.0.0/Changelog.md

[annaswims]

@johnpaulashenfelter It's not quite the same code validate_entry_sizes has a different default and support for ruby <2.4 is dropped. This CVE doesn't really apply to us since we're not unzipping files uploaded by users (yet).

rubyzip/rubyzip@v1.3.0...master