Update oj to 3.17.8 to fix native memory-safety bugs

What does this MR do and why?

Updates oj from 3.17.7 to 3.17.8.

oj 3.17.8 fixes roughly 20 native memory-safety bugs present in 3.17.7, including several segmentation faults, use-after-frees, and memory corruption issues. See the oj changelog (3.17.8).

Motivation

GitLab.com incident INC-15953 saw ~427 Ruby worker segmentation faults on a single webservice pod, generating ~16,900 HTTP 502s. All crashes were on the notes/discussions request path, which serializes a large amount of JSON through oj. Symbolizing the crashes against the deployed Ruby binary showed a corrupted method-definition pointer (cme->def stomped to 0x2a) for ResourceEvents::MergeIntoNotesService#initialize, i.e. a classic use-after-free where a live object's memory was freed and reused.

oj 3.17.7 is the most recently updated native extension on this path (bumped 2026-10-13, three weeks before the incident) and rewrote GC-sensitive hash parsing. oj 3.17.8, released on the incident day, closes a large batch of use-after-free and memory-corruption bugs. This bump is the leading mitigation for that incident.

Note: this does not yet prove the single oj defect that produced the stomp; a repro under GC.stress (3.17.7 crashing vs 3.17.8 clean) is the confirmation step and will be done separately. The patch bump is low risk and worth landing regardless.

MR acceptance checklist

• Gemfile.lock and Gemfile.next.lock both updated and in sync.