Remediate CVE-2026-54297 (faraday)

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
faraday:faraday	dependencies	security	unknown → 2.14.3

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2026-54297

---

Bump strategy

faraday CVE-2026-54297 fix

• faraday is a direct runtime dependency, declared in puppet_forge.gemspec
  (this repo has no gem pins in Gemfile — it just does gemspec, so the
  gemspec is the manifest for runtime deps).
• Old constraint: spec.add_runtime_dependency "faraday", "~> 2.0". This
  technically permitted 2.14.3, but set no floor — Bundler could just as
  easily have resolved to an older, vulnerable 2.x release. Gemfile.lock
  is gitignored in this repo, so a lockfile that happens to show 2.14.3
  today is not durable; the next resolve (Mend's scan, CI, this bot) could
  land back on a vulnerable version with no code change.
• New constraint: >= 2.14.3", "< 3.0" — enforces the fix as a floor while
  preserving the original "stay on faraday 2.x" intent.
• Re-ran bundle lock; regenerated Gemfile.lock now resolves faraday to
  2.14.3. bundle check passes.
• No cohort: faraday-follow_redirects and faraday-net_http are versioned
  independently of faraday (not pinned at the same current version), so
  they were left untouched.