In a production environment, `git` is not always available.  Since
vendored gemspecs are parsed during boot, this will fail.

Since `vendor/` is excluded from all Rubocop rules, we have to use a
separate invocation for this:
https://github.com/rubocop/rubocop/issues/6323. Alternatively, we
could maintain a local `vendor/.rubocop.yml`, but new cops would have
be disabled expliclty as well.

Relates to https://gitlab.com/gitlab-com/gl-infra/production/-/issues/7584