Bump REXML to 3.3.6 to address CVE-2024-43398

[cthorn42]

Our puppet-runtime for both puppet-agent 7.x and puppet-agent main are using REXML 3.3.4, https://github.com/puppetlabs/puppet-runtime/blob/38fc20bfbe8025e06645db2eab087b48a052b9ec/configs/components/rubygem-rexml.rb#L2.
A recently announced CVE, https://www.cve.org/CVERecord?id=CVE-2024-43398, means we need to bump the REXML we're using.

[github-actions]

Migrated issue to PA-6901

[joshcooper]

Fixed in puppetlabs/puppet-runtime#904