Security/remediate rubygems alerts

[hursey013]

Summary

Remediates five Dependabot findings through targeted RubyGems updates:

• addressable 2.8.0 → 2.9.0
• concurrent-ruby 1.1.8 → 1.3.8
• rexml 3.4.1 → 3.4.4

Jekyll remains at 4.2.0 to minimize dependency churn.

Cloud.gov Pages compatibility

Cloud.gov Pages now defaults to Ruby 4.0.5, which is incompatible with the existing Jekyll 4.2.0/Liquid 4.0.3 stack. This PR pins Ruby 3.1.7, the final Ruby 3.1 release, to restore deployment compatibility.

Ruby 3.1 is end-of-life and receives no further security fixes, so this pin should be treated as temporary. Moving to Ruby 4 will require follow-up work, including:

• Upgrading Jekyll/Liquid to versions that do not use the removed String#tainted? API.
• Addressing logger, which is no longer included as a Ruby 4 default gem.
• Verifying Bundler and native dependencies such as sassc, ffi, and eventmachine under Ruby 4.
• Regression-testing generated pages, assets, links, scripts, styles, and accessibility-related behavior.
• Removing the Ruby 3.1 pin after the upgraded stack builds successfully on Ruby 4.

Validation

• Frozen dependency resolution and bundle check passed.
• Production Jekyll build passed on Ruby 3.1, generating 315 HTML pages.
• bundle-audit reported no known vulnerabilities.
• Generated JavaScript syntax and representative page and asset smoke checks passed.
• No templates, content, styles, scripts, or accessibility test cases were changed.

[drewnielson]

@hursey013, are you planning a subsequent set of updates? The Section508.gov repository is pinned at Ruby 3.4.9, and Ruby 3.4 is continuing to receive regular maintenance updates. We would prefer to align with the Section508.gov repository.