pytest-homeassistant-custom-component pins transitive deps via homeassistant;
we cannot override pyjwt/cryptography floor versions in requirements_test.txt.
These CVEs are upstream HA's responsibility. Keep only idna (unconstrained by HA).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>