Dedup the scanner report for unpatched gems with more than one platform

[jrodriigues]

Fixes #438.

The scanner now deduplicates the unpatched gems on [gem.name, gem.version, advisory.id].

Notice that the spec can considered flaky. Without adding the Gemfile.lock change, it will pass as well.
Let me know if you are happy with this approach or if you prefer something more robust.

[jasnow]

I was waiting until another team member returns from vacation, but my thought is to
keep the old behavior if the user uses "--verbose" or "-v" so both groups are happy.

[jrodriigues]

That makes sense, I will push something to cover that scenario.