Add ruby-shadow to build

1. In Chef 18.x, chef/chef#11659 modified the
    Chef user provider to require the `ruby-shadow` gem anytime the
    NGINX user exists. This was introduced in order to update
    `/etc/shadow` with an expiration date, if present.

2. Previously it was not required because we don't set a password for
    the user:
    https://github.com/chef/chef/blob/v17.10.15/lib/chef/provider/user.rb#L69

3. The Chef Omnibus package ships with `ruby-shadow`, as it is listed
   in the `Gemfile`:
   https://github.com/chef/chef/blob/3c35bd0e1d17a5bfd779fab3cc7860ea1923dec6/Gemfile#L43

4. This gem isn't listed in the `.gemspec`, so Ruby doesn't include it
   as an explicit requirement. However, Omnibus GitLab now needs this.

Relates to https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17417

Author: stanhu

.custom_sources.yml

@@ -154,3 +154,6 @@ ncurses:
 pgbouncer:
   remote: "[email protected]:omnibus-mirror/pgbouncer.git"
   alternative: "https://gitlab.com/gitlab-org/build/omnibus-mirror/pgbouncer.git"
+ruby-shadow:
+  remote: "[email protected]:omnibus-mirror/ruby-shadow.git"
+  alternative: "https://gitlab.com/gitlab-org/build/omnibus-mirror/ruby-shadow.git"

config/software/chef-gem.rb

@@ -32,6 +32,7 @@
 dependency 'rubygems'
 dependency 'libffi'
 dependency 'rb-readline'
+dependency 'ruby-shadow'
 
 build do
   patch source: "license/add-license-file.patch"

config/software/ruby-shadow.rb

@@ -0,0 +1,43 @@
+#
+# Copyright 2012-2015 Chef Software, Inc.
+# Copyright 2017-2023 GitLab Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name 'ruby-shadow'
+# From https://github.com/chef/chef/blob/3c35bd0e1d17a5bfd779fab3cc7860ea1923dec6/Gemfile#L41-L44
+version = Gitlab::Version.new('ruby-shadow', '3b8ea40b0e943b5de721d956741308ce805a5c3c')
+default_version version.print(false)
+display_version version.print(false)
+
+license 'Apache-2.0'
+license_file 'LICENSE'
+
+skip_transitive_dependency_licensing true
+
+dependency 'rubygems'
+
+source git: version.remote
+
+relative_path 'ruby-shadow'
+
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+
+  # Remove existing built gems in case they exist in the current dir
+  delete 'ruby-shadow-*.gem'
+
+  gem 'build ruby-shadow.gemspec', env: env
+  gem 'install ruby-shadow-*.gem --no-document', env: env
+end