Constrain rexml version (or remove dep?)

[adsr]

Hello, given fallout from ruby/rexml#131 I think it may be a good idea to version constrain rexml to a minor version.

Separately, is rexml actually used? I don't see anything requiring it.

[mishina2228]

I was also curious to see if rexml was being used, but I suspect it is not.
#11024 was proposed, but it was eventually closed without being merged.
Related:

• #871
• #899

[dazuma]

removed from dependencies