uv.lock contains lots of packages with known CVEs

[adhami3310]

this is not an issue in the resulting package but it might be helpful to do uv sync --upgrade

[adhami3310]

CI doesn't contain specified permissions as well, which makes github unhappy

[adhami3310]

cryptography package still has some issues