Possible fix(deps): 5 vulnerable dependencies in Gemfile.lock

Spotted what might be an issue in `Gemfile.lock` around line 171.

Vulnerability: CVE-2024-49761 (HIGH) - The project locks the `rexml` gem at version 3.2.6 in Gemfile.lock (line 171), which is affected by a Regular Expression Denial of Service (ReDoS) vulnerability. When REXML parses XML containing a hex numeric character reference with an excessive number of digits (e.g., `&#x...;` with many digits between `&#` and `;`), a regex in the parser suffers from catastrophic backtracking, causing excessive CPU consumption. An attacker who can supply malicious XML to any code path that parses it with REXML (e.g., ActiveSupport::XmlMini when Nokogiri is unavailable, or direct REXML usage) can exhaust CPU and cause a denial of service. Impact: unauthenticated denial of service if attacker-controlled XML reaches a REXML parser. Risk level: HIGH. Note: per the CVE, only Ruby 3.1 (and earlier) exhibits the crash behavior, so applications on Ruby >= 3.2 have reduced practical exposure — but upgrading is still strongly recommended as rexml < 3.3.9 remains flagged and vulnerable to the pathological parsing behavior. Remediation: upgrade to rexml >= 3.3.9.

Something like this might fix it:

````diff
Do not hand-edit Gemfile.lock. Update the gem via Bundler, and pin a safe floor in the Gemfile to prevent regressions:

1) Run:
bundle update rexml

2) Gemfile diff (add explicit constraint):
```diff
--- a/Gemfile
+++ b/Gemfile
@@
# Security: CVE-2024-49761 (ReDoS in hex numeric character reference parsing)
+gem "rexml", ">= 3.3.9"
```

3) Resulting Gemfile.lock change:
```diff
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@
- rexml (3.2.6)
+ rexml (3.3.9)
```

4) Verify after updating:
bundle exec gem list rexml # confirm >= 3.3.9
bundle audit check-update # re-scan to confirm the finding is resolved

If `rexml` is a transitive dependency of rails/activesupport, the explicit Gemfile entry plus `bundle update rexml` ensures the resolved version satisfies the >= 3.3.9 requirement. Also consider confirming the deployment Ruby version is >= 3.2, where the reported crash behavior does not occur.
````

For reference: rule `CVE-2024-49761`. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*