cachi2 should also cache bundler of the locked version

[gsaslis]

This issue was originally reported by @akostadinov on the Cachito issue tracker. I am recreating the feature request here.

cachi2 presently does not cache bundler because it is usually (or never?) not pinned as a dependency with version in the Gemfile.lock [1].

But it is important for the same version of bundler to be installable and used for resolving dependencies.

At the bottom of a Gemfile.lock, there is

BUNDLED WITH
2.3.4
Cachito needs to cache bundler of this version so that builds can install it into the system. Using the bundler from the build image does not usually fit.

P.S. If BUNDLED WITH is not present, only then do not cache bundler. For example if project uses gem install -g instead of bundle install.

Acceptance criteria

• contribute BUNDLED WITH support to the scancode-toolkit gemfile.lock parser (https://github.com/nexB/scancode-toolkit/blob/develop/src/packagedcode/gemfile_lock.py)
• sync changes from the upstream parser to the vendored one at https://github.com/containerbuildsystem/gemlock-parser
• make cachi2 download (and report) bundler at the locked version

As an additional piece of information, I wanted to add that the capability to parse the BUNDLED WITH information has already been contributed (and merged!) to the upstream projects, so that it can be used by cachi2.

[akostadinov]

FYI the gemlock-parser already has BUNDLED WITH support applied with containerbuildsystem/gemlock-parser#3

So the only further change needed is with cachi2, regards.