fix(deps): re-lock the advisories Dependabot cannot move

[dependabot-global-policies]

Written by the pin-override action on a schedule. uv.lock only —
pyproject.toml is untouched.

Re-locked in range means uv lock --upgrade-package '<pkg><next-line>':
each package pip-audit named moved to the newest release inside its own
compatibility line (its major, or its minor below 1.0), and the rest of the
lock stays pinned where it was. Dependabot proposes one exact version instead,
and stops proposing it at all once a PR for it has been closed by hand.

Everything below was verified by re-running pip-audit over a fresh
uv export — anything that did not actually clear its advisory was reverted
rather than left in place.

Re-locked in range:

• urllib3 2.7.0 → 2.8.0 (unknown, GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, GHSA-vxq7-64xx-v4gw)

Left for a human

Nothing.

Review notes

• ci runs the python-pins check, uv sync --group dev and the pytest suite
  against the regenerated lock. A person merges this; six repos import this
  library from an unpinned git URL, so a merge here reaches them at their next
  build.
• pip-audit reads the PyPA advisory database, so it can name an advisory
  before GitHub has a Dependabot alert for it; the alert, when it arrives,
  closes on its own once this lands.