[Aikido] Fix 10 security issues in json, rspec-its, rexml and 1 more

[aikido-autofix]

Targeted updates to remediate security findings while preserving existing behavior

Upgrade json, rspec-its, rexml, and faraday to fix heap memory corruption (RCE), string mutation during parsing, private variable exposure, and XML parsing DoS vulnerabilities.

✅ 10 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-10977	HIGH	[json] A heap buffer overflow vulnerability exists in the native generator when computing output buffer capacity for repeated indent/spacing strings, potentially causing memory corruption. Additionally, an unchecked depth option can cause denial of service through excessive nesting work.
AIKIDO-2026-10978	MEDIUM	[json] A use-after-free vulnerability in JSON parsing allows concurrent mutation of the source string during parsing through Ruby-level hooks, potentially causing memory corruption and parsed value divergence. The patch freezes or copies the source buffer to prevent modification during parsing.
AIKIDO-2024-10421	MEDIUM	[rspec-its] A vulnerability allows unintended access to private or protected variables through public methods, exposing internal object states that should remain hidden and potentially compromising application security.
CVE-2024-43398	MEDIUM	[rexml] A denial of service vulnerability exists when parsing XML documents with deeply nested elements sharing identical local name attributes, affecting the tree parser API. Untrusted XML inputs can cause excessive resource consumption and application unavailability.
CVE-2024-35176	MEDIUM	[rexml] A denial of service vulnerability exists when parsing XML with many < characters in attribute values, allowing attackers to cause excessive processing and resource consumption through specially crafted XML documents.
CVE-2024-49761	LOW	[rexml] A ReDoS vulnerability exists in XML parsing when processing hex numeric character references with many digits, causing excessive backtracking and potential denial of service. This affects Ruby 3.1 and earlier versions.
CVE-2024-41123	LOW	[rexml] is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVE-2024-41946	LOW	[rexml] is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVE-2024-39908	LOW	[rexml] XML parser contains multiple Denial of Service (DoS) vulnerabilities triggered by parsing XML with specific character sequences like <, 0, and %>. Untrusted XML input can cause excessive resource consumption and application unavailability.
AIKIDO-2025-10223	LOW	[faraday] A thread safety vulnerability exists in the proxy option where the provided hash is mutated by adding keys, causing RuntimeError in multi-threaded environments. This issue allows attackers to trigger denial of service by exploiting unsafe hash modification in concurrent scenarios.

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #32