Bump vulnerable gems flagged by bundler-audit

[maebeale]

What is the goal of this PR and why is this important?

• The scan_ruby CI job (bundler-audit) is failing on every branch because new CVE advisories have been published since main last ran CI
• None of the flagged gems are direct dependencies we use heavily, but bundler-audit fails the build on any open advisory
• Get CI green again so feature PRs can land

How did you approach the change?

• Ran bundle update --conservative on each gem with an open advisory: addressable, net-imap, nokogiri, rack, rack-session
• Verified locally with bundle exec bundler-audit check --update — "No vulnerabilities found"

Gems updated

Gem	From	To	Why
addressable	2.8.8	2.9.0	CVE-2026-35611 (ReDoS)
net-imap	0.6.3	0.6.4	CVE-2026-42245/42246/42256/42257/42258
nokogiri	1.19.2	1.19.3	CSS tokenizer ReDoS + XSLT memory leak
rack	3.2.5	3.2.6	CVE-2026-26961/26962 (multipart parsing)
rack-session	2.1.1	2.1.2	Transitive bump

UI Testing Checklist

• CI scan_ruby job passes
• CI build-and-test job passes
• No app-level regressions (gem updates are all patch-level)

Anything else to add?

• Only Gemfile.lock is touched; no Gemfile constraints change