chore: upgrade dependencies

[nymous]

The HexaPDF upgrade has been "visually tested", by generating a PDF with the 0.40.0 and the 1.2.0 and comparing the two ^^

Thanks to the turbo-rails upgrade we can remove the workaround because we don't use ActionCable.

I also needed to upgrade to Ruby 3.4 to fix standard gems confusion when running the CI (bundler/rubygems would confuse the bundled error_highlight gem when we have a specific version in our Gemfile). This in turn meant that I could remove our Brakeman configuration ignoring the end-of-life or Ruby 3.1, and add checksums to dependencies in Gemfile.lock (ensuring that if a gem is compromised on the RubyGems.org server we won't install it).

Code coverage for ERB files has not yet been enabled, as it would reduce the total code coverage. We will add it in a future PR.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (e2c71ad) to head (5bdbfde).
Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #492   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           48        48           
  Lines          670       665    -5     
  Branches        53        53           
=========================================
- Hits           670       665    -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.