Insecure path handling in Bundler

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with
insecure permissions as a storage location for gems, if locations under the user’s
home directory are not available. If Bundler is used in a scenario where the user
does not have a writable home directory, an attacker could place malicious code
in this directory that would be later loaded and executed.