Upgrade cryptography to resolve GHSA-537c-gmf6-5ccf

[blaipr]

SUMMARY

Upgrades cryptography from 46.0.7 to 49.0.0 to resolve GHSA-537c-gmf6-5ccf.

cryptography is tightly coupled to pyOpenSSL in this repo (requirements.in already pins pyOpenSSL to track the cryptography pin), so moving cryptography to 49 has to move the two packages that cap it below 49. They go together as one coordinated set, all bumped to their current latest:

• cryptography 46.0.7 -> 49.0.0 (fixes GHSA-537c-gmf6-5ccf)
• pyOpenSSL 26.0.0 -> 26.3.0 (26.0.0 requires cryptography<47; 26.3.0 requires cryptography>=49)
• msal 1.34.0 -> 1.37.0 (1.34.0 caps cryptography<49; 1.37.0 allows <51)

cryptography cannot be bumped on its own; pyOpenSSL and msal are forced compatibility bumps.

ISSUE TYPE

• Bug, Docs Fix or other nominal change

COMPONENT NAME

• API

ASCENDER VERSION

awx: 25.4.1.dev61+g50c72c324c

ADDITIONAL INFORMATION

Found by pip-audit against requirements/requirements.txt on current main. Validated in the dev container with the three new versions installed:

• pip check reports no conflicts among cryptography / pyOpenSSL / msal (the only unrelated notice is a pre-existing tox/cachetools dev pin).
• Django boots cleanly (django.setup()), and cryptography, OpenSSL and msal import.
• The credential-encryption unit suite awx/main/tests/unit/utils/test_encryption.py passes 11/11 (Fernet encrypt/decrypt is the main cryptography consumer).