Upgrade Ruby to 3.4.9 and drop resolved CVE ignores

[etdsoft]

Summary

Bumps the Ruby runtime from 3.4.6 to 3.4.9 via .ruby-version and Gemfile, and regenerates Gemfile.lock.

3.4.9 ships the fixes for CVE-2025-61594 and CVE-2025-58767, so the corresponding ruby-audit ignores in the CI workflow are no longer needed and have been removed. The CVE-2026-41316 ignore remains (it needs Ruby >= 4.0.3, and we already override the bundled erb).

Testing steps

1. Ensure Ruby 3.4.9 is installed (rbenv install 3.4.9 or equivalent).
2. From the project root, confirm ruby --version reports 3.4.9.
3. Run bundle install — it should complete without a version mismatch warning.
4. Run bundle exec ruby-audit check --ignore CVE-2026-41316 — should report no vulnerabilities.
5. Boot the app (bin/dev) and confirm it starts and serves requests normally.

Other Information

Full local CI run green: bundler-audit, ruby-audit, brakeman, rubocop, and rspec (the sole rspec failure was a flaky Selenium browser crash that passes on rerun).

I assign all rights, including copyright, to any future Dradis work by myself to Security Roots.

Check List

• Added a CHANGELOG entry
• Commit message has a detailed description of what changed and why.