especially since they are often ERB, not Ruby files even though they have
an .rb extension.

This commit introduces a new check that creates a warning when it
detects a call to verify_mode= when the right hand of the assignment is
OpenSSL::SSL::VERIFY_NONE.

fixes #281

not redirects or other calls.

Fixes #395

and process Gemfile before config, because config location
depends on Rails version.

Fixes #398

closes #391

this was supposed to be part of 5ffafd80

in practice, this ends up with annoying false positives

in particular, don't try to retroactively build call chain.
Fixes #385

fixes #372

and a password literal

closes #206 finally

and add test for it so it won't happen again

and combine with YAML checks