fix: require starlette>=1.3.1 to clear known CVEs

The starlette lower bound allowed releases affected by CVE-2026-48710 and
related advisories. Raise the minimum to 1.3.1, which resolves them.

Close #6038

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 948661065

Author: GWeale

pyproject.toml

@@ -48,7 +48,7 @@ dependencies = [
   "python-multipart>=0.0.9,<1",
   "pyyaml>=6.0.2,<7",
   "requests>=2.32.4,<3",
-  "starlette>=1.0.1,<2",
+  "starlette>=1.3.1,<2",
   "tenacity>=9,<10",
   "typing-extensions>=4.5,<5",
   "tzlocal>=5.3,<6",