Detect locally-sourced gems in bundle_report outdated

[JuanVqz]

Description

bundle_report outdated looked up each installed gem's latest version on rubygems by name only. A gem pulled in via path: (for example a private engine) that happens to share its name with an unrelated public gem was matched against the public one and reported as out-of-date with a bogus upgrade suggestion.

This adds NextRails::GemInfo#sourced_locally?, which reads the Bundler source type from the lockfile. A gem is considered local when its source is a Bundler::Source::Path that is not a Bundler::Source::Git (git sources subclass the path source and are already reported separately via sourced_from_git?).

BundleReport.outdated now:

• excludes locally-sourced gems from the out-of-date check, and
• reports them in a separate count, mirroring how git-sourced gems are handled (new sourced_locally_count in the JSON output and a new "N gems are sourced from a local path" line in the human-readable footer).

Motivation and Context

Closes #29.

A local private gem named app_store collides with the abandoned public app_store gem. bundle_report would suggest "upgrading" the private engine to the unrelated public version.

As discussed in the issue, this does not try to decide whether two same-named gems are the same gem (gemspec metadata is unreliable). It trusts the lockfile source instead: a path: gem is local, so it is not compared against rubygems at all.

How Has This Been Tested?

• Added specs for GemInfo#sourced_locally? covering path, git, and rubygems sources.
• Added a BundleReport.outdated spec asserting a locally-sourced gem is excluded from the out-of-date list and counted separately, plus updated the existing JSON/stdout expectations.
• Full suite green (99 examples, 0 failures).
• Verified end-to-end with a sandbox app that declares a local app_store gem via path::
  • released next_rails (buggy): app_store listed: true
  • this branch: app_store listed: false, footer shows it under "sourced from a local path".

Screenshots:

N/A

I will abide by the code of conduct

[JuanVqz]

I used this issue-29-sandbox.zip to QA and confirm this works, sharing it, so, it's easier for you

[arielj]

how can this happen that this class does not exist?

is this some Bundler version thing that it didn't exist in some older versions? it would be good to either add a comment explaining that (it would mean this works only for some minimum bundler version) or find an alternative to this for when Bundler::Source::Path is not defined

[arielj]

Suggested change

	end.tap { |s| s.source = source }
	s.source = source
	end

this doesn't work? that extra tap looks off, is this some limitation of how the let blocks are called?