Add explicit dependency to 'cgi' for ruby 4.0 support

[vcsjones]

Ruby 4.0 (currently preview 2) has removed the default dependency on CGI:

CGI library is removed from the default gems. Now we only provide cgi/escape for the following methods:

We use CGI::Cookie

secure_headers/lib/secure_headers/headers/cookie.rb

Line 63 in 8b1029c

@parsed_cookie ||= CGI::Cookie.parse(raw_cookie)

So we should take an explicit dependency on the cgi gem.

[Copilot]

Pull request overview

This PR adds an explicit dependency on the cgi gem to ensure compatibility with Ruby 4.0, which has removed cgi from its default gems (except for cgi/escape). Since the codebase uses CGI::Cookie.parse (which is NOT part of cgi/escape) and CGI.unescape in lib/secure_headers/headers/cookie.rb, this dependency is necessary for the gem to function properly with Ruby 4.0.

Key Changes:

• Added cgi gem as a runtime dependency with version constraint ~> 0.5.0

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rei-moo]

Shall we add Ruby 4.0 support to our CI matrix here as well?

We'll need to update setup-ruby to a version that supports 4.0

[vcsjones]

@rei-moo I added 4.0.0-preview2 as well as 3.4. We can bump it to 4.0.0 GA when its available.

[vcsjones]

@rei-moo Hm. Looks like the setup-ruby dropped ruby 2.6 support. That seems reasonable to me, but we will need to remove it from being a required check.

[rei-moo]

@vcsjones I believe you can already specify 4.0 directly in the workflow despite it not being GA.

Hm. Bummer about losing 2.6 support in setup-ruby. I'll look into trying to make sure that we still support older versions for as long as is reasonable. Dropping from CI makes sense for now. 👍

[rei-moo]

Looks good! Thank you 👏