Don't add bin/brakeman if brakeman is not in bundle

Running `bin/rails app:update` with Rails 7.2.0 adds bin/brakeman even
if it's not in the Gemfile already.

This checks whether brakeman is in the bundle (can be required),
otherwise skips brakeman for the application generator.

railties/lib/rails/commands/app/update_command.rb

@@ -69,6 +69,7 @@ def generator_options
               skip_action_mailbox: !defined?(ActionMailbox::Engine),
               skip_action_text:    !defined?(ActionText::Engine),
               skip_action_cable:   !defined?(ActionCable::Engine),
+              skip_brakeman:       skip_brakeman?,
               skip_test:           !defined?(Rails::TestUnitRailtie),
               skip_system_test:    Rails.application.config.generators.system_tests.nil?,
               asset_pipeline:      asset_pipeline,
@@ -87,6 +88,13 @@ def asset_pipeline
               nil
             end
           end
+
+          def skip_brakeman?
+            require "brakeman"
+            false
+          rescue LoadError
+            true
+          end
       end
     end
   end

railties/test/generators/app_generator_test.rb

@@ -286,6 +286,16 @@ def test_app_update_preserves_skip_action_text
     end
   end
 
+  def test_app_update_preserves_skip_brakeman
+    run_generator [ destination_root, "--skip-brakeman" ]
+
+    FileUtils.cd(destination_root) do
+      assert_no_changes -> { File.exist?("bin/brakeman") } do
+        run_app_update
+      end
+    end
+  end
+
   def test_app_update_preserves_skip_test
     run_generator [ destination_root, "--skip-test" ]