Sinatra returns 403 from all requests when deployed, due to running in development by default

I think from #149 the intention is anyone deploying this has `RACK_ENV=production` set, arrived at the same discovery but for a different reason recently and this might get worse with 2.8.0 being released and newer Sinatra's being installed. We ran into a strange issue where gemstash master (now 2.8.0) would serve traffic fine locally, or from localhost but as soon as we deployed it every request would get a 403 back. Eventually traced it back to Sinatra's Host Protection middleware kicking in because it defaults to running in development env out the box. Reproduction: ```shell $ mise use ruby@3.3.10 $ gem install gemstash -v 2.8.0 $ gemstash start Starting gemstash! ``` Then make a request to a public endpoint that should return a response, including the `Host` header we'd get from production: ```shell $ curl -i -H "Host: gems.example.com" http://localhost:9292/versions HTTP/1.1 403 Forbidden content-type: text/plain x-content-type-options: nosniff vary: Accept-Encoding content-length: 18 Host not permitted ``` The solution is to run Sinatra in a non-development environment, which then allows the `Host` header to be a non-ip/localhost value without returning 403 responses. Much like #149 running it with `RACK_ENV=production` does the trick. ```shell $ RACK_ENV=production gemstash start Starting gemstash! ``` ```shell $ curl -i -H "Host: gems.example.com" http://localhost:9292/versions HTTP/1.1 302 Found location: https://index.rubygems.org/versions content-type: text/html;charset=utf-8 x-xss-protection: 1; mode=block x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-length: 0 ``` I'm 50/50 on whether this needs fixing, or just documenting. There's no mention of it in the Readme currently which is likely why it bit us not having it set (and we've a bunch of rubyists/devops folks that definitely know `RACK_ENV` is a thing 😬), I think adding a note around ensuring its set in the Readme would suffice to share the knowledge. I wonder if gemstash should default to running Sinatra in production mode though, presumably development mode is only really useful when developing in gemstash itself, at all other times we don't really want Sinatra debugging responses, etc unless configured. Not sure what an appropriate mechanism would be for that and maybe just setting `RACK_ENV` is enough.