Refresh locked dependencies

[tomchop]

Clears all nine Dependabot alerts on the default branch.

package	was	now	alerts cleared	needed
urllib3	2.2.3	2.7.0	4 high, 2 moderate	≥ 2.7.0
requests	2.32.3	2.34.2	2 moderate	≥ 2.33.0
idna	3.10	3.19	1 moderate	≥ 3.15

Lock-only, and worth being precise about what that means

pyproject.toml is unchanged: requests = "^2.32.3" already permitted every fixed version, so this is purely the lock catching up. No constraint was ever blocking the fix.

It also means no published artifact was affected. poetry.lock is not shipped in the wheel — the wheel carries ranges:

Requires-Dist: requests (>=2.32.3,<3.0.0)
Requires-Dist: click (>=8.1.7,<9.0.0)
Requires-Dist: requests-toolbelt (>=1.0.0,<2.0.0)

so anyone installing yeti-python resolves their own transitive versions and was never pinned to the vulnerable ones. These alerts described this repository's CI and development environment. Still worth clearing — a lockfile that installs known-vulnerable versions is what CI actually runs — but nothing downstream needs to re-release.

What is deliberately not here

ruff stays on 0.8.x. The ^0.8.3 constraint caps it below 0.9, and going to current (0.16.6) costs a reformat of one file plus five stylistic findings:

tests/api.py:1:1  I001     Import block is un-sorted or un-formatted
yeti/api.py:6:1   UP035    Import from `collections.abc` instead: `Sequence`
yeti/api.py:9:8   PLR0402  Use `from requests_toolbelt.multipart import encoder`
yeti/api.py:11:8  PLR0402  Use `from yeti import errors` in lieu of alias
yeti/client.py:1:1 I001    Import block is un-sorted or un-formatted

All style, no correctness or security content. Mixing it in would bury a three-line security change in an import-shuffling diff. Happy to do it as its own PR if wanted.

pyrefly is already current at 1.2.0.

Verified

The three CI jobs, run against the new lock:

=== unittest ===  Ran 37 tests in 0.030s  OK
=== pyrefly ===   INFO 0 errors
=== ruff ===      6 files already formatted / All checks passed!