Phase 0.1 — Update urllib3 (HIGH: decompression-bomb + redirect chain)

[fsecada01]

Context

urllib3 has multiple HIGH/MEDIUM-severity vulnerabilities:

• Decompression-bomb safeguards bypassed when following HTTP redirects
• Streaming API improperly handles highly compressed data
• Allows an unbounded number of links in the decompression chain
• Redirects not disabled on PoolManager when retries disabled (MEDIUM)

Steps

uv lock --upgrade-package urllib3
uv run pytest tests/

Confirm urllib3 Dependabot alerts resolved on GitHub after push.

See wiki roadmap for full context.