Address all packaging dependency alerts

[ihalatci]

Summary

• consolidate the latest packaging dependency updates into one generated lockfile
• update every vulnerable package to at least its first patched version
• include required transitive updates for cryptography, h11, and black
• apply the single formatting-only change required by Black 26.3.1

This is expected to resolve all 36 currently open Dependabot alerts after merge: 1 critical, 15 high, 15 moderate, and 5 low.

Local validation

• regenerated lock exactly matches pip-compile under Python 3.10
• installed package set passes dependency compatibility and import checks
• Black formatting check passes
• Prospector reports zero findings
• 21 targeted packaging tests pass

CI exercises the repository's Git- and Docker-backed workflows.