fix(deps): update protobuf dependency to version >=7.36.0

[ArthurTonial]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Bumps protobuf from >=6.33.5,<7 to >=7.36.0 to fix CVE-2026-0994 (BDSA-2025-123809).

The vulnerability allows a remote attacker to trigger a stack overflow via uncontrolled recursion in the ParseDict function. The partial fix in 6.33.5 / 6.33.6 only patched _ConvertAnyMessage(), leaving _ConvertStructMessage(), _ConvertListOrTupleValueMessage(), and _ConvertGenericMessage() exploitable. The complete fix is available only in 7.36.0+.

uv.lock updated accordingly; resolved version is 7.36.1.

Related Issue

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Run uv sync to install updated dependencies
2. Run uv run pytest tests/ --ignore=tests/integration — all unit tests should pass
3. Verify the installed version: uv run python -c "import google.protobuf; print(google.protobuf.__version__)" — should print 7.36.1

Checklist

Before submitting your PR, please review and check the following:

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Breaking Changes

N/A — no breaking changes observed in tests.

Additional Notes

• CVE-2026-0994 / BDSA-2025-123809, severity Medium 6.1
• The only call site in this repo is MessageToDict in src/sap_cloud_sdk/core/auditlog_ng/client.py:237, which converts outbound audit log events — not user-supplied input. Risk is low, but upgrading is the correct response.
• a2a-sdk was also bumped from 1.1.2 → 1.0.2 as a side effect of dependency resolution; verify this is acceptable.

[NicoleMGomes]