Add explicit dependency to 'cgi' for ruby 4.0 support

[vcsjones]

Ruby 4.0 (currently preview 2) has removed the default dependency on CGI:

CGI library is removed from the default gems. Now we only provide cgi/escape for the following methods:

We use CGI::Cookie

https://github.com/github/secure_headers/blob/8b1029ca6d9a424b903b5beebcd88cbdadf43f4b/lib/secure_headers/headers/cookie.rb#L63

So we should take an explicit dependency on the cgi gem.