Refresh plugin dependencies and versions

[lucarlig]

Summary

• Refresh compatible Rust and Python dependency locks for the six managed CPEX plugins.
• Patch-bump plugin versions and matching plugin manifests.
• Update release-validation fixture tags and catalog tests for the new versions.
• Run retry_with_backoff coverage validation with the plugin uv Python so the Python 3.11+ catalog check does not fall back to system Python 3.9.

Refs #69

Validation

• make plugins-validate
• PYO3_PYTHON=$PWD/plugins/rust/python-package//.venv/bin/python make plugin-test PLUGIN= for encoded_exfil_detection, pii_filter, rate_limiter, retry_with_backoff, secrets_detection, url_reputation

Notes

• Major direct dependency upgrades for redis and rand are intentionally not included in this PR; this is a compatible lockfile refresh.
• Standard detailed code review has not been run yet; run it before marking the PR ready.

[msureshkumar88]

Review

Verdict: Approve — no major issues. Changes are a clean lockfile refresh + consistent version bumps.

What this PR does

• Patch-bumps all 6 plugins (encoded_exfil_detection, pii_filter, rate_limiter, retry_with_backoff, secrets_detection, url_reputation)
• Refreshes Cargo.lock and uv.lock with compatible upstream updates (patch/minor bumps only; rand and redis major bumps intentionally deferred per PR notes)
• Fixes retry_with_backoff/Makefile to use uv run python instead of bare python3 — correctly enforces plugin-venv Python 3.11+ for coverage check
• Updates CI fixture tag, catalog pinning, and catalog tests to match new versions

Verification

Version consistency — for all 6 plugins, Cargo.toml version and plugin-manifest.yaml version are in sync. No drift.

Cargo.lock notable bumps

Crate	Old	New	Type
pyo3 family	0.28.2	0.28.3	patch
wasm-bindgen	0.2.117	0.2.120	patch
tokio	1.50.0	1.52.1	minor
rayon	1.11.0	1.12.0	minor
indexmap	2.13.0	2.14.0	minor
hashbrown	0.16.1	0.17.0	minor
icu_* suite	2.1.x	2.2.0	minor

All within declared semver constraints. No unexpected major bumps.

wit-bindgen dual version (0.51.0 + 0.57.1 in lockfile) — expected, two separate transitive dep chains; not a concern.

Makefile fix — python3 $(REPO_ROOT)/tools/plugin_catalog.py → uv run python $(REPO_ROOT)/tools/plugin_catalog.py is the right fix. System Python 3.9 fallback would cause incorrect behavior for Python 3.11+ catalog checks.

Test updates — purely mechanical version-number updates tracking the new releases. No logic changes.

CI

CI is still running at time of review (all build-test and release-validation jobs queued/in-progress). Approve is contingent on CI green — please confirm before merging.

Minor note

PR description says "Standard detailed code review has not been run yet; run it before marking the PR ready." If that refers to an internal automated review tool, please run it before merge. The changes themselves are straightforward and low-risk.

[msureshkumar88]

LGMT