Merge main for the httpx2/httpcore2 security bumps, and align the hatch pins

Brings in #348 and #349, which move httpx2 and httpcore2 to 2.12.0 and
close five Dependabot advisories (GHSA-8xx6-hgc6-gc2m and
GHSA-7mj9-2mp8-4m2p high, three medium).

No CLI code change is needed for these, and the reason is worth recording:
httpx2 is not a runtime dependency. It arrives transitively through
`hatch` in the dev extra, so it is absent from the published wheel's
Requires-Dist and never reaches anyone installing socketsecurity from
PyPI. Nothing under socketsecurity/ imports httpx or httpcore, and the
only hatch commands this repository runs are `hatch version` and
`hatch build`, neither of which performs HTTP. The advisories describe
build-tooling exposure on developer machines and CI runners, not shipped
surface.

Verified against the release path rather than assumed: hatch version,
hatch build, twine check, and a no-deps wheel install with a bytecode
compile all pass on 2.12.0, as do the 568 unit and core tests.

Separately, the same investigation turned up three different pins for the
same build tooling: build-system.requires wanted hatchling 1.32.0, the dev
extra pulled 1.28.0 via hatch 1.18.0, and .github/actions/setup-hatch
installed hatchling 1.27.0 with hatch 1.14.0 -- so CI ran an older hatch
than local development. The artifact was never affected, because
`hatch build` resolves the backend in an isolated environment from
build-system.requires and the wheel records `Generator: hatchling 1.32.0`.
The composite action now matches the other two, verified by building in a
clean virtualenv with the new pins.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

.github/actions/setup-hatch/action.yml

@@ -6,8 +6,15 @@ description: >-
 runs:
   using: "composite"
   steps:
+    # Kept in step with pyproject.toml: `hatch` matches the dev extra and
+    # `hatchling` matches [build-system].requires. hatchling is pinned here only
+    # for consistency -- `hatch build` resolves the backend in an isolated
+    # environment from build-system.requires, so that pin is what actually
+    # produces the wheel (the artifact records `Generator: hatchling 1.32.0`).
+    # Three different values for the same tool across three files was only ever
+    # going to mislead someone debugging a build.
     - shell: bash
       run: |
         python -m pip install --upgrade pip
         pip install "virtualenv<20.36"
-        pip install hatchling==1.27.0 hatch==1.14.0
+        pip install hatchling==1.32.0 hatch==1.18.0