Restrict to rexml 3.0 - 3.2.6

rexml 3.2.7 added a runtime dependency on strscan, which requires native
extensions on MRI Ruby and whose StringScanner.match method behaves
differently depending on whether you're using the native or Java
extension.

See ruby/rexml#131

facter.gemspec

@@ -36,6 +36,7 @@ Gem::Specification.new do |spec|
   # Facter without a compiler.
   spec.add_development_dependency 'ffi', '1.15.5'
   spec.add_development_dependency 'rake', '~> 13.0', '>= 13.0.6'
+  spec.add_development_dependency 'rexml', '~> 3.2', '<= 3.2.6'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 1.28' # last version to support 2.5
   spec.add_development_dependency 'rubocop-performance', '~> 1.5.2'