chore(deps): bump minimum requests to 2.31 (CVE-2018-18074)

[skl]

Description

An image scanner for a downstream build depending on the otel-injector triggered on a CVE-2018-18074 alert. Investigation showed the otel-injector depends on an outdated version of the requests package as a transitive dependency via this repo (opentelemetry-python).

This PR bump the requests dependency floor to ~= 2.31, for consistency with several existing requirements.txt files across this repo for minimum impact and compatibility.

Note that 2.32 was originally tried but found to be incompatible via CI checks on 0e17e3d.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

I'm not familiar with this repo, I'm open to guidance on test requirements outside of the standard PR checks, if any.

Does This PR Require a Contrib Repo Change?

• Yes. - Link to PR:
• No.

Checklist:

• Followed the style guidelines of this project
• Changelogs have been updated
• Unit tests have been added
• Documentation has been updated

[xrmx]

These are for compatibility of the API and does not dictate what end users will ends with.

[xrmx]

IOW the requirements / uv.lock / docker images downstream people are using should be kept up to date, we occasionally bump ours but they are just for testing

[xrmx]

To workaround this we've started using the system docker in -contrib, see open-telemetry/opentelemetry-python-contrib@23ac232

[herin049]

I agree with @xrmx here, pyproject.toml dependencies only indicate API compatibility. It is the user's responsibility to select a specific compatible version for the package. If you want to constrain which versions are allowable to be installed, you should use a constraints file: https://pip.pypa.io/en/latest/user_guide/#constraints-files

[skl]

Thanks both for the review, I'll close based on the discussion.