Remove REXML instead of patching it
There have been at least 3 rexml vulerabilities to date,
having to patch ruby just to make sure it's not being used is taking a lot
Afaik most people do not use xml anyway (and especially not rexml), just
for comparison: it would make much more sense to have json included, but
So let's just drop it & make it a gem.