Addresses #2857

Name: nokogiri
Version: 1.6.7
Advisory: CVE-2015-5312
Criticality: High
URL:
https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
Title: Nokogiri gem contains several vulnerabilities in libxml2
Solution: upgrade to >= 1.6.7.1

https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1

This reverts commit e426c027, reversing
changes made to c3676aa1.

Also fixes an incorrect redirect after login with relative URL root:

Closes https://github.com/gitlabhq/gitlabhq/issues/8228

Closes #2750

Closes #3767

Updated Sidekiq to 3.5.x

Two issues:

1. The constraints in the resources were incorrect. Here's what it was before:
```
group_milestone  GET /groups/:group_id/milestones/:id(.:format)  groups/milestones#show {:id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```

In this case, id is actually the title of the milestone, which can be anything at the moment.

After:

```
group_milestone  GET /groups/:group_id/milestones/:id(.:format)  groups/milestones#show {:id=>/[^\/]+/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```

2. `parameterize` would strip all Unicode characters, leaving a blank string. Rails would report something like:

ActionView::Template::Error (No route matches {:action=>"show", :controller=>"groups/milestones", :group_id=>#<Group id: 48, name: "ops-dev", path: "ops-dev", owner_id: nil, created_at: "2015-11-15 08:55:30", updated_at: "2015-12-02 06:23:26", type: "Group", description: "", avatar: "sha1.c71e73d51af1865c1bbbf6208e10044d46c9bb93.png", public: false>, :id=>"", :title=>"肯定不是中文的问题"} missing required keys: [:id]):

This change uses the babosa library to create a better slug, which surprisingly
isn't actually used by the global milestone controllers. Instead, they use the
title passed as a query string for some reason.

Closes https://github.com/gitlabhq/gitlabhq/issues/9881

Fix constraints

Updated Sidekiq to 3.5.x

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

See #2857

Closes #2830

Closes #2746

Also removes `colored` which came in during the CI merge and is
redundant.

Closes #2822

Closes #2815

Closes #2856

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>