Add explicit dependency to 'cgi' for ruby 4.0 support

[vcsjones]

Ruby 4.0 (currently preview 2) has removed the default dependency on CGI:

CGI library is removed from the default gems. Now we only provide cgi/escape for the following methods:

We use CGI::Cookie

secure_headers/lib/secure_headers/headers/cookie.rb

Line 63 in 8b1029c

@parsed_cookie ||= CGI::Cookie.parse(raw_cookie)

So we should take an explicit dependency on the cgi gem.

[Copilot]

Pull request overview

This PR adds an explicit dependency on the cgi gem to ensure compatibility with Ruby 4.0, which has removed cgi from its default gems (except for cgi/escape). Since the codebase uses CGI::Cookie.parse (which is NOT part of cgi/escape) and CGI.unescape in lib/secure_headers/headers/cookie.rb, this dependency is necessary for the gem to function properly with Ruby 4.0.

Key Changes:

• Added cgi gem as a runtime dependency with version constraint ~> 0.5.0

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.