chore: Constrain vulnerable transitive dependencies

[johnnygreco]

What

Adds workspace-level uv constraints for the transitive dependencies flagged in the vulnerability report:

• urllib3>=2.7.0
• python-multipart>=0.0.29

Refreshes uv.lock so the workspace resolves urllib3 to 2.7.0 and python-multipart to 0.0.29.

Why

The attached scan report identified vulnerable resolved versions of urllib3 (2.6.3) and python-multipart (0.0.26) in the Data Designer plugin dependency tree. These packages are pulled transitively through Data Designer dependencies, so the fix belongs in the workspace constraint list rather than individual plugin runtime dependencies.

Usage

No plugin configuration changes are required. After pulling this branch, run:

make sync

The workspace and isolated plugin test environments resolve the patched versions automatically through the root tool.uv.constraint-dependencies configuration.

How

Updated the root pyproject.toml constraint list with patched lower bounds and regenerated uv.lock with:

uv lock --upgrade-package urllib3 --upgrade-package python-multipart

Validation

• make sync
• git diff --check
• make all

make all passed, including linting, devtools tests, isolated plugin tests, plugin validation, catalog/package-index checks, license header checks, and docs build.