Upgrade rexml to 3.3.6 to fix CVE-2024-43398

[raymzag]

Resolves CVE-2024-43398

Name: rexml
--
  | Version: 3.2.8
  | CVE: CVE-2024-43398
  | GHSA: GHSA-vmwr-mc7x-5vc3
  | Criticality: Medium
  | URL: https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
  | Title: REXML denial of service vulnerability
  | Solution: update to '>= 3.3.6'

Tests

bundle exec rake test:local

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
6012 tests, 80277 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
177.93 tests/s, 2375.84 assertions/s
Running RuboCop...
Inspecting 801 files
.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

801 files inspected, no offenses detected

Tip: Based on detected gems, the following RuboCop extension libraries might be helpful:
  * rubocop-rake (https://github.com/rubocop/rubocop-rake)

You can opt out of this message by adding the following to your config (see https://docs.rubocop.org/rubocop/extensions.html#extension-suggestions for more options):
  AllCops:
    SuggestExtensions: false