fix(deps): urllib3 2.8.0, tornado 6.5.10 and anyio 4.14.2

Yunshuang Yuanrequested to merge
fix/urllib3-tornado into maintain/0.4

urllib3 2.7.0, tornado 6.5.8 and anyio 4.14.0 carry nine published advisories. The audit gate fails on maintain/0.4, v0.5.0 and exp, so no supported line can be pushed — this blocks cutting maintain/0.5 and the fixes for #58 (closed), #60 (closed), #63 (closed), #64 (closed).

Lockfile only, plus a CHANGELOG entry.

Once merged: maintain/0.4 → maintain/0.5 (cut from v0.5.0) → exp.

Merge request reports