Bump rexml to >= 3.3.9 to resolve GHSA-2rxp-v6pw-ch6m

[RemoteCTO]

A ReDoS vulnerability in REXML has been identified in versions <3.3.9

Details in GitHub:

• GHSA-2rxp-v6pw-ch6m

This is a small bump to the latest patched version. This should resolve anybody getting the following bundle audit error when using overcommit:

Name: rexml
Version: 3.3.8
CVE: CVE-2024-49761
GHSA: GHSA-2rxp-v6pw-ch6m
Criticality: High
URL: https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
Title: REXML ReDoS vulnerability
Solution: update to '>= 3.3.9'

[sds]

Thank you.