Patch/GitHub vulrn

[msweier]

• idna: 3.11 → 3.18 (CVE-2026-45409) — compatible with 3.9+
• pygments: 2.19.2 → 2.20.0 (CVE-2026-4539) — compatible with 3.9+
• black: 24.10.0 → 26.3.1+ (CVE-2026-32274) — dev-only, constrained to 3.10+ via python = "^3.10" marker
• pytest: 8.4.2 → 9.0.3+ (CVE-2025-71176) — dev-only, constrained to 3.10+ via python = "^3.10" marker
• filelock: 3.19.1 → 3.24.3 (CVE-2025-68146, CVE-2026-22701) — transitive dev dep, resolved on 3.10+ automatically
• requests 2.32.5 (CVE-2026-25645) — no 3.9-compatible fix, transitive from cwms-python
• urllib3 2.6.3 (PYSEC-2026-141, PYSEC-2026-142) — no 3.9-compatible fix, transitive from requests
• Added .github/dependabot.yml with pip ecosystem to enable Dependabot alerts for Python dependencies
  AI assisted