Pin mocha to 1.9.x for bourne compatibility

This should go some way to fixing broken tests on master.

Fixes https://gitlab.com/gitlab-org/gitlab-mail_room/-/issues/12

This MR adds Gemfile.lock so at least tests become repeatable.

I picked mocha 1.9.x because I found a passing build from November 2019 somewhere, and mocha 1.10.x was released after that.