Update ransack to 4.x

[jrochkind]

We use ransack to avoid some boilerplate in our admin dashboards, around sorting and filtering on Collection and Work lists.

Ransack 4.0 has a backwards breaking change where you NEED to list all attributes you want ransack to operate on in allowlist methods in the model (Work or Collection).

It's not much well-documented, but see activerecord-hackery/ransack#1400

This is a security improvement, there were some potential holes there. (Mostly not applicable to use, because our own uses of ransack are all behind admin logins, but still better to be a tight ship -- and stay on the latest dependencies generally).

I really don't like having to add methods to the MODELS. This would ideally have been controller-level. But that's not what ransack chose. In general, ransack seems to be kind of barely maintained (see lack of docs for this change, for instance)... I'd love to move away from it. We actually barely use it, the main convenient thing it does for us involves those SORT headers, where you can click on any header to sort ASC or DESC. Without ransack it'd be a lot of boilerplate. Perhaps we should extract the parts that just do that into it's own gem or something.

But meanwhile, we get everything working for ransack 4.0.

Unfortunately, if we MISSED an attribute in the allowlist -- the default behavior is just for it to no-op not include it in the search/sort. But i've tested everything manually pretty thoroughly on admin Work and Collection, which seems via a sourcecode search to be only place we use ransack. I've tried turning on the ransack configuration to RAISE -- only in dev and test -- instead of silently ignoring. But that does not seem to actually work for sorting, our main use case. activerecord-hackery/ransack#1427

Commits:

• update ransack gem to 4.0
• allowlist Work attributes for ransack 4.x
• allowlist Collection attributes for ransack 4.x
• try to have ransack error in dev/test when we missed an allowlist item, in cases where it can do so

---

This PR is built on top of #2223 and that needs to be merged first.

[eddierubeiz]

Noted!