fix: update vulnerable dependencies

[EdwardWills-nhs]

• lxml: ^5.1.0 -> ^6.1.0 (CVE fix, earliest fixed version 6.1.0)
• pytest: ^8.4.2 -> ^9.0.3 (CVE fix, earliest fixed version 9.0.3)
• werkzeug: add >=3.1.6 (CVE fix, earliest fixed version 3.1.6)
• openapi-core: ^0.19.5 -> ^0.20.0 (unblock werkzeug update)
• pytest-nhsd-apim: ^5.0.6 -> ^6.0.0 (unblock lxml and pytest updates)

Summary

• Routine Change
• ❗ Breaking Change
• 🤖 Operational or Infrastructure Change
• ✨ New Feature
• ⚠️ Potential issues that might be caused by this change

Add any other relevant notes or explanations here. Remove this line if you have nothing to add.

Reviews Required

• Dev
• Test
• Tech Author
• Product Owner

Review Checklist

ℹ️ This section is to be filled in by the reviewer.

• I have reviewed the changes in this PR and they fill all or part of the acceptance criteria of the ticket, and the code is in a mergeable state.
• If there were infrastructure, operational, or build changes, I have made sure there is sufficient evidence that the changes will work.
• I have ensured the changelog has been updated by the submitter, if necessary.

[Copilot]

Pull request overview

Routine dependency bump to address known CVEs in lxml, pytest, and werkzeug, with two transitive upgrades (openapi-core, pytest-nhsd-apim) required to unblock those updates. Changes are limited to pyproject.toml and the corresponding poetry.lock.

Changes:

• Bump lxml to ^6.1.0 and pytest to ^9.0.3 for CVE remediation.
• Add an explicit werkzeug >=3.1.6 constraint and bump openapi-core to ^0.20.0 to permit it.
• Bump pytest-nhsd-apim to ^6.0.0 to satisfy the new lxml and pytest ranges.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Updates dependency version constraints for the CVE fixes and unblockers.
poetry.lock	Regenerated lock file reflecting the new resolved versions.

[georgeCraftReferrals]

lgtm