fix(deps): pin transitive deps to resolve Trivy CVE alerts

Adds minimum version constraints for indirect dependencies with
known vulnerabilities:
- gitpython >=3.1.47 (CVE-2026-42215, CVE-2026-42284 - HIGH)
- langchain-text-splitters >=1.1.2 (CVE-2026-41481)
- langsmith >=0.7.31 (CVE-2026-41182)
- mako >=1.3.11 (CVE-2026-41205)
- marshmallow >=3.26.2 (CVE-2025-68480)
- python-dotenv >=1.2.2 (CVE-2026-28684)
- requests >=2.33.0 (CVE-2026-25645)

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

a2a/weather_service/pyproject.toml

@@ -37,6 +37,13 @@ dependencies = [
     "starlette>=0.49.1",        # Indirect; prevents CVE-2025-62727
     "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
     "aiohttp>=3.13.5",          # Indirect; prevents CVE-2025-69223
+    "gitpython>=3.1.47",        # Indirect; prevents CVE-2026-42215, CVE-2026-42284
+    "langchain-text-splitters>=1.1.2", # Indirect; prevents CVE-2026-41481
+    "langsmith>=0.7.31",        # Indirect; prevents CVE-2026-41182
+    "mako>=1.3.11",             # Indirect; prevents CVE-2026-41205
+    "marshmallow>=3.26.2",      # Indirect; prevents CVE-2025-68480
+    "python-dotenv>=1.2.2",     # Indirect; prevents CVE-2026-28684
+    "requests>=2.33.0",         # Indirect; prevents CVE-2026-25645
 ]
 
 [project.scripts]