rails update

[Sylvain Beucler <beuc@beuc.net>]

Hi Security Team,

I see that 'rails' is present in dsa-needed.txt.

I'm currently testing an update for jessie and I can prepare an update
for stretch (which appears to be similar).
(not sure what's the plan for buster)
Would you be interested?

Note: since there's 2:4.2.7.1-1+deb9u2 in stretch-proposed-updates,
would it be OK to prepare a deb9u3 straight for stretch-security?

Cheers!
Sylvain