Update `rack-timeout` and make it `require:`'d

What does this MR do?

This is second take on:

• !36071 (merged)
• #219623 (closed)
• Reverted by !36229 (merged)

This actually follows the guidelines from the https://github.com/sharpstone/rack-timeout/blob/master/README.md#rails-apps-manually.

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content