chore: resolve dependency security alerts

[psteinroe]

Update vulnerable Rust and Python dependencies reported by Dependabot, including rustls-webpki, rand, lru, Jinja2, and Markdown.

Dependency security updates

The Rust lockfile now resolves to patched versions for the open rustls-webpki, rand, and lru advisories. The direct lru dependency in pgls_workspace was widened to allow the patched release.

Python dependency age guard

Added uv.toml with a three-day exclude-newer window so uv resolution avoids newly published packages, matching the existing npm and bun minimum release age policy.

Validated with cargo check --workspace --all-targets --all-features --locked, cargo clippy --workspace --all-targets --all-features --locked, uv lock --check, uv sync --locked, uv run mkdocs build --strict, and uv audit.