Set BUNDLE_FROZEN to true
To follow rubygems' security adisory https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79:
We go with this option over --deployment
to match what we did on gitlab-org/gitlab (gitlab!87053 (merged))
Closes #562 (closed)