[Fix #10570] Add new Gemspec/DependencyVersion cop

[nobuyo]

Resolves #10570.

This cop requires/forbids version specifications or a commit reference for gem dependency in gemspec.

The name for cop suggested in the issue was GemVersion, but I'm renaming it because cop is interested in the version of the dependency, not the gem owning gemspec.

example

# EnforcedStyle: required (default)

# bad
Gem::Specification.new do |spec|
  spec.add_dependency 'rubocop'
end

# good
Gem::Specification.new do |spec|
  spec.add_dependency 'rubocop', '~> 1.28'
end

# EnforcedStyle: forbidden

# bad
Gem::Specification.new do |spec|
  spec.add_dependency 'rubocop', '~> 1.28'
end

# good
Gem::Specification.new do |spec|
  spec.add_dependency 'rubocop'
end

---

Before submitting the PR make sure the following are checked:

• The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
• Wrote good commit messages.
• Commit message starts with [Fix #issue-number] (if the related issue exists).
• Feature branch is up-to-date with master (if not - rebase it).
• Squashed related commits together.
• Added tests.
• Ran bundle exec rake default. It executes all tests and runs RuboCop on its own code.
• Added an entry (file) to the changelog folder named {change_type}_{change_description}.md if the new code introduces user-observable changes. See changelog entry format for details.

[koic]

There is a similar argument in #7669, I think it should be disabled by default.

Suggested change

	Enabled: pending
	Enabled: false

[nobuyo]

Thanks, I think .rubocop.yml should be revert back together too, so I'll fix this directly on my local branch.

[bbatsov]

I think you can enable this for RuboCop itself. I'm a fan of explicit versions everywhere.

[nobuyo]

Thank you for your review, I've updated PR.

[bbatsov]

Thanks!

[ShockwaveNN]

I'm a fan of explicit versions everywhere.

Just a sidenote from my experience - I've maintain a lot of very simple gems, required for my project and I found out the best experience - to store Gemfile.lock file in git as well (Althrough a lot of guides mention that you should not store Gemfile.lock in gem repos)

This allow fine tuning for dependabot updates and allow to specify dev dependencies for gems more preciese

[koic]

Althrough a lot of guides mention that you should not store Gemfile.lock in gem repos

I also have this idea. Unlike applications, the runtime_dependency of gemspec affects user's library-dependent version management. And I think SCM should not store gem repo's Gemfile.lock. In my maintenance experience, bot updates haven't helped much. Well, it may depend on the developer :-)