deps: make :cmark optional (native NIF out of the core) + bump all deps

[ivarvong]

Summary

• :cmark is now an optional dependency. It ships native code (the C CommonMark NIF) that the core has no reason to force on every consumer. It follows the repo's established optional-backend shape (:postgrex/sql, :explorer/pandas): optional: true in mix.exs, Pyex.Stdlib.Markdown wrapped in if Code.ensure_loaded?(Cmark), and import markdown degrading to a clean Python ImportError via Pyex.Stdlib.fetch/1. Consumers who want markdown.markdown(...) add {:cmark, "~> 0.10"} and the feature lights up unchanged.
• scripts/consumer_smoke.sh now also asserts Cmark is absent from the bare package and that import markdown raises ImportError — so the consumer-smoke CI job guards this the same way it guards sql/pandas.
• README "Optional backends" section updated (two → three modules).
• Bump every other dep to the latest the constraints allow: req 0.5.17→0.6.2, bandit 1.10.3→1.12.0, decimal 2.3.0→2.4.1, jason 1.4.5, postgrex 0.22.2, telemetry 1.4.2, tz 0.28.2, ex_doc 0.40.3, benchee 1.5.1, yaml_elixir 2.12.2, plus transitives (finch 0.23, mint 1.9, plug 1.20.2, …).
• decimal 3.1.1 is not taken: blocked by postgrex (~> 1.5 or ~> 2.0), jason (~> 1.0 or ~> 2.0), and explorer (~> 2.1) requirements — revisit when the ecosystem moves.

Notes

• The riskiest bump is req 0.6 (backs Pyex.Stdlib.Requests); the full suite including the bypass-based HTTP tests and the External HTTP Integration CI jobs cover it.
• Pre-existing Dialyzer/compile situation unchanged: three type warnings in lib/pyex/interpreter{,/assignments}.ex appear only on local Elixir 1.20.2 (CI's 1.19.5/1.20.0-rc.4 don't emit them) and exist on main — untouched here.

Test plan

• mix format --check-formatted
• mix compile --warnings-as-errors (modulo the pre-existing 1.20.2-local warnings noted above)
• mix test — 6492/6493 (the one failure is the known local-OTP zipfile CRC-message artifact, present on main)
• mix dialyzer — clean
• scripts/consumer_smoke.sh — bare package compiles; Cmark absent; import markdown → clean ImportError
• CI green (watching)

🤖 Generated with Claude Code

https://claude.ai/code/session_01KuxYKoh8pXEna5ohZUgJsn