Figure out how to consolidate gem dependency declarations

There are multiple locations for expressing gem dependencies (depending on workflow) and they all disagree with one another:

• When consuming puppet-agent packages, component definitions are pulled from https://github.com/puppetlabs/puppet-agent/blob/master/configs/projects/puppet-agent.rb#L223-L270 (Note that some of these are transitive dependencies consumed by hiera / other gems)
• When consuming the puppet gem, per-platform .gemspec files are built via the rake task at https://github.com/puppetlabs/packaging/blob/master/tasks/gem.rake - this uses a template and dependency declarations inside project_data.yaml where platform-specific gems are needed
• When cloning the git source of Puppet and performing a bundle install, the dependencies are specified in Gemfile which as of PUP-7425 calls the .gemspec, which also consumes project_data.yaml - this is the install mechanism for local dev, TravisCI and AppVeyor
• When using Bundler that specifies Puppet as a git style ref (such as in ci:test:git), the workflow is similar to the above, except that the .gemspec is the primary mechanism of consumption, and the Gemfile is ignored

Unfortunately the dependency definitions are not cleanly spelled out, which can lead to inconsistent gems installed depending on the environment above.

Ideally the .gemspec is the source of truth, noting that a .gemspec should always declare runtime dependencies statically (i.e. it should not contain Ruby code which programmatically varies the gems based on platform, as this can make it difficult to inspect a gem through the interface at rubygems.org and cleanly understand dependency relationships - to handle that situation and ship only a single gem for all platforms for instance, gemspec.extensions = 'ext/mkrf_conf.rb' can be used - but that effort should be constrained to another ticket. Such an approach is defined at https://en.wikibooks.org/wiki/Ruby_Programming/RubyGems#How_to_install_different_versions_of_gems_depending_on_which_version_of_ruby_the_installee_is_using).

This ticket should be about a best effort to make gem dependencies appear in only location, so that the above supported workflows consume the same sets of gems.