Use frozen setting to disallow changes to Gemfile.lock

As per the Rubygems.org advisory, we should use either the frozen or deployment options as defense-in-depth to mitigate supply chain attacks - https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79

Please note that --frozen flag is deprecated so we should use bundle config set --local frozen 'true' instead.

See gitlab-org/gitlab-pages#758 (closed)