Pin json gem to ~> 2.3

[mroderick]

Pin json gem to ~> 2.3

Why

Dependabot group PR #2864 is red across all six test groups. The PR body lists four gems (haml, image_processing, bullet, webmock), but the lockfile diff contains a fifth, unadvertised change: json 2.21.2 → 3.0.2, a major release pulled in transitively by rubocop's json >= 2.3 constraint.

json 3.0 (released 2026-09-07) made JSON.parse keyword-only and now raises on options it doesn't recognise instead of ignoring them. Rails 8.1's ActiveSupport::JSON.decode calls ::JSON.parse(json, options) with a positional hash. Ruby 4.0 cannot promote an empty positional hash to keywords, so json 3.0.2 raises:

ArgumentError: wrong number of arguments (given 2, expected 1)
  json-3.0.2/lib/json/common.rb:296 in 'JSON.parse'
  activesupport-8.1.3.1 .../messages/metadata.rb:129 deserialize_from_json
  actionpack-8.1.3.1 .../cookie_store.rb ... get_cookie

Every request that reads the encrypted session cookie crashes, which is why the failure signature (session.key? in ApplicationController#current_user) appears in nearly every feature and controller spec.

The fix

Pin json ~> 2.3 in the Gemfile. The lockfile resolves back to json 2.21.2 and Dependabot will stop bumping it in the ruby-deps group.

Verification

• Reproduced the CI failures locally on the chore(deps): bump the ruby-deps group across 1 directory with 4 updates #2864 branch (spec/features/member_joining_spec.rb: 4/4 failing with the same ArgumentError).
• With the pin added (and chore(deps): bump the ruby-deps group across 1 directory with 4 updates #2864's four bumps still applied), those specs pass again, plus all 203 controller/request specs.
• On this branch: member_joining_spec.rb 4 examples, 0 failures.

Once Rails supports json 3.x, drop the pin.