Upgrade yard to version 0.9.11 or later

[emma5678]

yard vulnerability has been present in penthouse.gemspec since Dec 2017. We need to upgrade to 0.9.11 or later.

This needs to be complete by April 2019.

Due to time passed, I would suggest updating to the very latest version, if greater than 0.9.11, unless an issue is identified with doing so.

Vulnerability details:

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

[emma5678]

@ryantownsend @krisquigley can this be addressed please.

[emma5678]

@ryantownsend @krisquigley can this ticket be prioritised please

[simonireilly]

Closed by #16 we no longer have a Gemfile.lock version pinning yard. The security dependency management is now in the vendor installing the gem.