chore(deps): constrain PyJWT>=2.15.0 and urllib3>=2.8.0 to resolve dependabot alerts

[jonpspri]

Summary

Resolves the actionable open dependabot security alerts against the root uv.lock:

• PyJWT 2.13.0 → 2.15.0 — covers 10 advisories, including the critical asymmetric-PEM detection bypass, JWKS redirect following, DER-keys-as-HMAC-secrets, ReDoS in is_pem_format, and the RecursionError DoS (first patched in 2.15.0).
• urllib3 2.7.0 → 2.8.0 — covers unbounded chunk-size-line buffering, HTTPS proxy TLS override, and chunked-deflate infinite loop (2 high, 1 medium).

Both packages are transitive dependencies (via mcp/cpex/requests), so they are pinned via tool.uv.constraint-dependencies rather than added to any project's core dependency list. uv.lock rebuilt with uv lock — only these two packages changed.

Alerts requiring no change

• anyio 4.14.2, cryptography 49.0.0, hpack 4.2.0 — already locked at or above the patched versions.
• Alerts against plugins/rust/python-package/*/uv.lock — those manifests were deleted in Update Python dependency locks and plugin catalog checks #121/fix(sql_sanitizer): analyse executable comments, join root uv workspace #159 when the plugins joined the root uv workspace; stale, will close on the next dependabot scan.
• output_length_guard alerts — plugin no longer exists on main.
• No open cargo/Rust alerts.

Verification

• uv lock --check passes
• uv sync --dev --all-packages — full install including all 7 maturin/Rust plugin builds
• Import check: pyjwt 2.15.0, urllib3 2.8.0; plugins import cleanly

[lucarlig]

No blocking findings in 855dace. The root dependency constraints and lockfile agree, and PyJWT is the only changed package record. urllib3 was already locked at 2.8.0 on the base branch; this PR adds its minimum-version constraint.

Verified uv lock --check with uv 0.12.13 and CI's pinned uv 0.9.30, a locked install of the ICA metering exporter, and make test-all (78 unit tests and 12 integration tests passed). All 37 active CI checks passed.