Security: bump activesupport, rexml, yard (#56)

* Security: bump activesupport, rexml, yard

- activesupport 7.0.4.3 -> 8.1.3 (major version bump)
- rexml 3.2.5 -> 3.4.4
- yard 0.9.36 -> 0.9.44

Addresses multiple security vulnerabilities across all three gems.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix CI: pin activesupport to 7.2.3.1 for Ruby 3.1 compatibility

activesupport 8.1.3 pulls in connection_pool 3.0.2 which requires
Ruby >= 3.2, breaking the Ruby 3.1 CI matrix entry. activesupport
7.2.3.1 patches the same 4 CVEs (GHSA-2j26, GHSA-cg4j, GHSA-89vf,
GHSA-cr5q) while requiring only Ruby >= 3.1. Cap connection_pool < 3
in the Gemfile to prevent bundler from resolving 3.x transitively.
Regenerate Sorbet RBIs for activesupport 7.2.3.1 and connection_pool 2.5.5.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix CI: resolve Sorbet RBI conflicts for rexml and yard

- Delete tapioca-generated rexml@3.4.4.rbi (Sorbet stdlib already covers REXML)
- Regenerate yard@0.9.44.rbi and add yard-sorbet@0.8.1.rbi so YARDSorbet::Handlers::StructClassHandler resolves

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people