[Security] Bump ruby-openid from 2.8.0 to 2.9.1

[dependabot-preview]

Bumps ruby-openid from 2.8.0 to 2.9.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

ruby-openid SSRF via claimed_id request
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable
flaw. This library is used by Rails web applications to integrate with OpenID Providers.
Severity can range from medium to critical, depending on how a web application developer
chose to employ the ruby-openid library. Developers who based their OpenID integration
heavily on the "example app" provided by the project are at highest risk.

Patched versions: >= 2.9.0
Unaffected versions: none

Release notes

Sourced from ruby-openid's releases.

v2.9.1

Update CHANGELOG with all the changes in v2.9.0
and update version.rb

v2.9.0

• Remove deprecated autorequire from gemspec.
  #123
• Rescue from Yadis::XRI::XRIHTTPError on discovery.
  #106
• Avoid SSRF for claimed_id request.
  #121
• Updated documentation.
  #115, #116, #117, #118
• Reduce warnings output in test runs.
  #119
• Drop deprecated option from gemspec.
  #120
• Remove circular require.
  #113
• Updated Travis CI config with Ruby 2.6
  #114
• Simplify Bundler require; remove need for extra :require.
  #112

Changelog

Sourced from ruby-openid's changelog.

2.9.1

• Updated CHANGELOG.md

2.9.0

• Remove deprecated autorequire from gemspec.
  #123
• Rescue from Yadis::XRI::XRIHTTPError on discovery.
  #106
• Avoid SSRF for claimed_id request.
  #121
• Updated documentation.
  #115, #116, #117, #118
• Reduce warnings output in test runs.
  #119
• Drop deprecated option from gemspec.
  #120
• Remove circular require.
  #113
• Updated Travis CI config with Ruby 2.6
  #114
• Simplify Bundler require; remove need for extra :require.
  #112

Commits

• 65963ca Update version to 2.9.1
• c05e0ef Update CHANGELOG.md
• 184518b Merge pull request #123 from ahorek/autorequire
• a0df64c remove autorequire
• aebc02e Merge pull request #106 from meineerde/fix/XRIHTTPError
• d181a8a Merge pull request #121 from faberge-eggs/SSRF-idref-fix
• 6182dc4 Merge pull request #117 from olleolleolle/patch-3
• 9c5111d Merge pull request #115 from olleolleolle/patch-1
• 3234bda Merge pull request #116 from olleolleolle/patch-2
• daa0878 Merge pull request #118 from olleolleolle/patch-4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[codecov]

Codecov Report

Merging #6789 into master will increase coverage by 0.04%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #6789      +/-   ##
==========================================
+ Coverage   80.64%   80.68%   +0.04%     
==========================================
  Files          97       97              
  Lines        5565     5567       +2     
==========================================
+ Hits         4488     4492       +4     
+ Misses       1077     1075       -2

Impacted Files	Coverage Δ
app/controllers/users_controller.rb	80.98% <100%> (+0.84%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 01d5ce6...13e3cf2. Read the comment docs.

[plotsbot]

	1 Warning
⚠️	There was an error with Danger bot’s Junit parsing: No JUnit file was found at output.xml

	2 Messages
📖	@dependabot-preview[bot] Thank you for your pull request! I’m here to help with some tips and recommendations. Please take a look at the list provided and help us review and accept your contribution! And don’t be discouraged if you see errors – we’re here to help.
📖	#

Screenshots 📸 (click to expand)

6789-test_questions.png

6789-test_embeddable_grids.png

6789-test_signup.png

6789-test_viewing_the_settings_page.png

6789-test_tag_by_author_page.png

6789-test_wiki_page_with_inline_grids.png

6789-test_stats.png

6789-test_viewing_the_dashboard.png

6789-test_searching_an_item_from_the_homepage.png

6789-test_questions_shadow.png

6789-test_login_modal.png

6789-test_profile_page.png

6789-test_comments.png

6789-test_tags.png

6789-test_signup_modal.png

6789-test_wiki.png

6789-test_methods.png

6789-test_tag_page.png

6789-test_blog_page_with_location_modal.png

6789-test_tag_wildcard.png

6789-test_embeddable_thumbnail_grids.png

6789-test_front_page_with_navbar_search_autocomplete.png

6789-test_login.png

6789-test_viewing_the_dropdown_menu.png

6789-test_viewing_question_post.png

6789-test_mobile_displays.png

6789-test_simple-data-grapher_powertag.png

6789-test_front.png

6789-test_question_page.png

6789-test_tag_contributors_page.png

6789-test_blog.png

6789-test_people.png

6789-test_wiki_revisions.png

Learn about automated screenshots

Generated by 🚫 Danger

[jywarren]

I would merge this but I'm afraid of the drop in coverage... I think it's an artifact though, as noting in #6290