chore(deps): address Dependabot / security advisories in uv.lock

Bump transitive packages (aiohttp, cryptography, tornado, pillow, requests,
pygments, python-multipart, cbor2) and tighten dev tooling floors (pytest,
black) to patched versions clearing GitHub/OSV-aligned findings.

Made-with: Cursor

Author: mplatzer

pyproject.toml

@@ -54,7 +54,7 @@ gpu = [
 
 [dependency-groups]
 dev = [
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-rerunfailures>=15.0",
     "ruff>=0.11",  # sync'ed with .pre-commit-config
     "pre-commit>=4.0",
@@ -69,7 +69,7 @@ docs = [
     "griffe>=1.0",
     "pymdown-extensions>=10.0",
     "griffe-fieldz>=0.2",
-    "black>=25.0",
+    "black>=26.3.1",
 ]
 
 [project.urls]