Apply security patches and bump to v0.8.0

[fusion94]

Summary

Apply the security dependency updates that were previously blocked by EOL Ruby/Rails versions, and version bump to reflect the full modernization across #51-#53.

Changes

• nokogiri >= 1.18.3 — explicit minimum version (addresses multiple CVEs from 1.16.x)
• rails-html-sanitizer >= 1.6.1 — explicit minimum version (HTML sanitizer bypass fix)
• Removed Gemfile.lock — gems should not commit lockfiles per RubyGems convention; consumers resolve their own dependency tree
• Added lockfiles to .gitignore — prevents accidental re-commit
• Version bump to 0.8.0 — reflects breaking change (Ruby >= 3.1, Rails >= 6.1 required)

Test Plan

• bundle install resolves with patched dependency versions
• No known CVEs in dependency tree (bundle audit clean)
• CI generates fresh lockfiles per gemfile matrix

Previously Blocked

These updates were blocked by Dependabot PRs #46, #47, #48 which failed CI on Ruby 2.5/2.6. Now that the CI matrix and codebase are modernized (#51, #52, #53), these patches resolve cleanly.

Closes #54