fix(deps): move legacy Rails e2e app off EOL 7.1 to resolve activestorage critical alert

[pkaeding]

Summary

Resolves Dependabot alert #1246 (critical, GHSA-xr9x-r78c-5hrm / CVE-2026-66066: Active Storage arbitrary file read / RCE via variant processing) in e2e/ruby/rails/demo-rails70/Gemfile.lock.

The advisory has no 7.1 backport — fixed versions are 7.2.3.2, 8.0.5.1, 8.1.3.1 — and the Rails 7.1 line no longer receives security patches, so the only fix for this app is to leave 7.1:

-gem 'rails', '~> 7.1.5', '>= 7.1.5.2'   # resolved 7.1.6
+gem 'rails', '~> 7.2.3', '>= 7.2.3.2'   # resolved 7.2.3.2

The app's "legacy" purpose is unchanged: it keeps config.load_defaults 7.0, Ruby 3.3.4, and the individually pinned Rails-family OTel instrumentations, which is what the regression coverage actually depends on. README wording updated accordingly.

The other two Ruby e2e apps (demo, api-only) were already on 7.2.3.2 and are unaffected.

How did you test this change?

bundle install && bundle exec rake in e2e/ruby/rails/demo-rails70 (the same command the e2e-rails-legacy CI job runs): 6 runs, 19 assertions, 0 failures, 0 errors — including the headline OTLP export test asserting the auto-instrumented Rails server span, log record, and exception reach the in-process OTLP sink.

Are there any deployment considerations?

No. Test/example app only; nothing published to customers.

Link to Devin session: https://app.devin.ai/sessions/51c4a25cece3420cb618dcd333933a3e
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring