Update rexml

[TonyCTHsu]

What does this PR do?

Update rexml due to CVE-2024-35176

[p-datadog]

Behavior of StringScanner#scan changed for ruby 2.7 to accept a string. The following is accepted by 2.7 but not 2.6:

irb(main):003:0> require'strscan'
=> true
irb(main):004:0> StringScanner.new('x').scan 'y'
=> nil

This usage is employed by rexml (latest).

jruby 9.2 & 9.3 follow ruby 2.6 behavior and reject it. jruby 9.4 (master) no longer implements strscan internally as 9.2 & 9.3 did, instead relying on the gem with the same name (perhaps extracted from MRI).

Unfortunately installing strscan on jruby 9.2 doesn't seem to fix the issue - it looks like jruby is prioritizing its bundled implementation of strscan over the installed gem.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.10%. Comparing base (4a3cc53) to head (b278b8e).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3656      +/-   ##
==========================================
- Coverage   98.10%   98.10%   -0.01%     
==========================================
  Files        1232     1232              
  Lines       72560    72560              
  Branches     3447     3447              
==========================================
- Hits        71188    71187       -1     
- Misses       1372     1373       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.