Refresh uv.lock for CVEs and add explicit CI permissions (closes #25)

[TimChild]

Summary

Closes #25.

• uv sync --upgrade to refresh uv.lock and clear the known CVEs flagged in the issue. Notable bumps: reflex 0.8.20 → 0.9.1, authlib 1.5.2 → 1.6.11, plus requests, urllib3, cryptography, etc.
• Authlib 1.6 tightened the type on jwt.decode; switched to JsonWebKey.import_key_set({"keys": jwks}) so we pass a KeySet instead of a raw dict (functionally equivalent — same JWKS payload, just wrapped).
• CI workflow permissions: Added explicit permissions: blocks to every workflow that lacked them so the GITHUB_TOKEN is no longer running with implicit defaults.
  • ci.yml, _reusable-ci.yml, ci-forks.yml → top-level contents: read
  • full-ci-comment.yml, full-ci-manual.yml → top-level contents: read; pull-requests: read on the PR-info jobs; pull-requests: write on the comment-posting jobs
  • deploy.yml, publish.yml already had per-job permissions — left as-is

Heads-up: reflex 0.8.20 → 0.9.1

This is the riskiest part of the upgrade. Reflex 0.9 restructured into separate reflex-base + reflex-components-* packages, which is why the lockfile diff is so noisy. Local checks pass:

• ruff check ✅
• pyright ✅
• pytest tests/test_clerk_provider_unit.py ✅
• python -m reflex.utils.pyi_generator reflex_clerk_api (the build-component step) ✅
• uv build ✅

What this PR can not verify locally is the playwright demo suite (tests/test_demo.py), which exercises the running demo against Clerk. That'll run as part of full CI on this PR — worth watching closely. If 0.9 breaks the demo flow, easiest mitigation is to pin reflex<0.9 in uv.lock while keeping the rest of the upgrade.

pyproject.toml's reflex>=0.8.0 constraint is unchanged, so published-package consumers aren't forced to 0.9.

Test plan

• Full CI passes (especially demo playwright tests on 0.9.1)
• Spot-check that set_clerk_session still validates a real Clerk JWT against the new KeySet path