RubyGems: Use of --source should not fallback to other sources

[williantenfen]

What was the end-user or developer problem that led to this PR?

--source is only appended to the source list, so if the requested source is
unreachable or doesn't carry the gem, gem install silently falls back to the
default sources and installs from there with a success exit code:

$ gem install paint --source https://example.com/
WARNING:  Unable to pull data from 'https://example.com/': Bad response Not Found 404
Successfully installed paint-2.3.0     # ← from rubygems.org, not the requested source

This is a source-substitution / dependency-confusion risk: if a private gem shares
a name with a public one, an attacker squatting that name can have their code
installed whenever the private source is down (flagged as "technically a security
issue" in the original report).

Refs #2313

What is your fix for the problem, implemented in this PR?

Gems named on the command line are now resolved only from the explicitly requested
--source(s), failing if not found there. Their dependencies still resolve from
all configured sources, so private gems that depend on public ones keep working.

--source records its URLs in options[:sources], which are passed to the resolver
as explicit_sources; InstallerSet#add_always_install then resolves the named
gems against a set built only from those sources, leaving dependency resolution
untouched.

The thread also suggested phasing this in via a deprecation warning first — happy to
do that instead if preferred.

Make sure the following tasks are checked

• Describe the problem / feature
• Write tests for features and bug fixes
• Write code to solve the problem
• Make sure you follow the current code style and write meaningful commit messages without tags