Ideally the ruleset should use rctx.download[_and_extract] to fetch dependency gems so that:

• they are cached in the bazel repository cache
• configuration of the Bazel downloader can be used, i.e. to ensure they are fetched from a corporate proxy
• bazel shows more information about the fetching phase than just "running bundler"
• we can apply patches to third-party gems in a similar way as other bazel fetches may be patched