upgrade transitive dependencies to resolve Dependabot alerts

urllib3 2.5.0 -> 2.6.3 (decompression-bomb CVEs)
fonttools 4.58.5 -> 4.61.1 (arbitrary file write CVE)
biopython 1.85 -> 1.86 (XXE injection CVE)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: TimoLassmann