Pin sprockets gem to < v4.0

Updating Rails to v6.1.0 causes sprockets to be updated to v4.0.2 as a
dependency. That version expects app/assets/config/manifest.js to be
present, which it is not since switching to webpacker. This causes an
error and prevents the server starting.

This commit adds sprockets to the gemfile and pins it as < v4.0 to
prevent any unexpected updates in future.

See rails/sprockets-rails#444 for discussion
of the issue.

Gemfile

@@ -98,6 +98,11 @@ gem 'secure_headers'
 # Identify file types before uploads
 gem 'mimemagic'
 
+# Sprockets isn't used by the app but is installed by rails as a dependency.
+# Versions >= 4 cause issues if app/assets/config/manifest.js is not present.
+# This pins sprockets to an earlier version to prevent those errors
+gem 'sprockets', '< 4'
+
 group :development, :test do
   gem 'awesome_print', '~> 1.8.0'
   gem 'byebug', platforms: %i[mri mingw x64_mingw]

Gemfile.lock

@@ -585,7 +585,7 @@ GEM
     spring-watcher-listen (2.0.1)
       listen (>= 2.7, < 4.0)
       spring (>= 1.2, < 3.0)
-    sprockets (4.0.2)
+    sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
     sprockets-rails (3.2.2)