Resolve Dependabot alerts in Jekyll dependencies

[SimonPickup]

Summary

• raise the explicit rexml floor to 3.3.9 and lock 3.4.4
• raise the explicit webrick floor to 1.8.2 and lock 1.9.2
• retain secure floors in Gemfile so a future lockfile refresh cannot regress below patched versions

This resolves all eight current Dependabot alerts in the repository (two high and six moderate).

Verification

• bundle check passes with Ruby 3.1.4 / Bundler 2.3.26
• bundle exec jekyll build --trace completes successfully