Upgrade dependencies with known HIGH/CRITICAL CVEs

Clears all HIGH/CRITICAL findings for the python-sdk from the Trivy scan:

- urllib3  2.6.3 -> 2.8.0   (direct; floor raised in pyproject + requirements)
- pyjwt    2.13.0 -> 2.15.1 (transitive; 1 critical + 5 high, auth bypass / token forgery)
- anyio    4.11.0 -> 4.15.1 (transitive; critical TLS cert spoofing)
- cryptography 49.0.0 -> 50.0.2 (transitive; PKCS#7 Bleichenbacher oracle)
- pyasn1   0.6.3 -> 0.6.4   (transitive; ASN.1 DoS)
- langgraph-sdk 0.4.2 -> 0.4.8 (transitive; authz bypass)

Transitive pins moved via poetry update; the only incidental bump is
typing-extensions 4.14.1 -> 4.16.0 (shared sub-dependency).

Author: nthmost-orkes