"Fix" CVE-2024-49761 by just ignoring rexml for now

[buggmagnet]

This PR fixes CVE-2024-49761 by upgrading rexml

---

This change is 

[linear]

IOS-910 Fix rexml - the boogaloo empire strikes back

[pinkisemils]

Would it not be better to ignore rexml in it's entirety?

[buggmagnet]

We can also do that, yes. I'll make the change

Reviewable status: 0 of 4 files reviewed, all discussions resolved

[faern]

You still need an expiry date. I pointed this out on slack. No ignore is allowed to be indefinite. See instructions at top of root osv-scanner.toml

[buggmagnet]

@faern no matter what I tried yesterday, I couldn't get osv-scanner to ignore the vulnerability when I was using an expiry date, the tool was just complaining about an invalid format.
Clearly I was doing something wrong, cause today it worked immediately.
Should be fixed now.

Reviewable status: 0 of 4 files reviewed, all discussions resolved

[pinkisemils]

Reviewed 2 of 4 files at r2, 2 of 2 files at r4, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved

[faern]

Reviewed 2 of 2 files at r5, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved

---

ci/ios/upload-vm/osv-scanner.toml line 2 at r5 (raw file):

[[PackageOverrides]]
effectiveUntil = 2025-04-01

An ignore longer than three months should ideally have a comment about why. But not critical.

[faern]

I'm trying to clarify the rules around ignoring entire packages with this PR: #7115

[faern]

Reviewed 2 of 2 files at r6, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved