Bump Ruby openssl gem past 3.2.x to clear SBOM EOL finding (vuln-mgmt#230637)

[siddharthkp]

Context

The primer-lookbook deployable container is flagged by SBOM-Kustodian EOL rule eol-eoldate-openssl-008 (tracked in github/vuln-mgmt#230637) for shipping OpenSSL 3.2.2, which endoflife.date lists as an end-of-life OpenSSL branch.

Investigation shows this is the Ruby openssl stdlib gem at version 3.2.2 (its own versioning), not the OpenSSL C library. The system OpenSSL in the ruby-base:v3.4-noble runtime image is 3.0.x LTS (supported). The scanner matches the gem's 3.2.x string against the OpenSSL library 3.2 EOL entry.

Task

Pin the Ruby openssl gem past the 3.2.x line so the SBOM no longer reports a 3.2.x version.

1. In demo/Gemfile, add near the top (right after the source "https://rubygems.org" line):

   # Pin the openssl stdlib gem past 3.2.x so the SBOM EOL scanner
   # (eol-eoldate-openssl-008) stops matching the OpenSSL 3.2 library EOL entry.
   gem "openssl", ">= 3.3"

2. Run cd demo && bundle update openssl to regenerate demo/Gemfile.lock with the newer gem.
3. If Bundler cannot resolve openssl >= 3.3 because a transitive dependency caps it, stop and report the conflicting gem in the PR description instead of forcing it.

Acceptance criteria

• demo/Gemfile pins openssl >= 3.3.
• demo/Gemfile.lock resolves the openssl gem to a 3.3.x (or newer) version.
• No other gems are changed beyond what the openssl bump requires.