Merge branch 'security-ruby-graphql' into 'master'

See merge request gitlab-org/security/gitlab!4832

Changelog: security

Merge branch 'security-dblessing-ruby-saml' into 'master'

See merge request gitlab-org/security/gitlab!4819

Changelog: security

The usage has been removed a while ago, let's remove the gem itself
from the Gemfile

The version we've been using - v5.1.0 - is more than four years out of
date. It doesn't include matchers for the use of
ActiveRecord::Encryption, which is important for us to have as we
migrate to ActiveRecord::Encryption from the attr_encrypted gem.

The version constraint on oj seems very strict, so let's relax it a
little bit, so that the version can be bumped independently in the
main lockfile.

- Fix breaking changes introduced by 0.28.0

The version constraint on json seems very strict, so let's relax it a
little bit, so that the version can be bumped independently in the
main lockfile.

Resynched with `bundle exec rake bundler:gemfile:sync`.

The version constraint on json seems very strict, so let's relax it a
little bit, so that the version can be bumped independently in the
main lockfile.

Changelog: fixed