build: urllib3 2.8.0 in the release lock (3 Dependabot alerts)

[philpaz]

Closes Dependabot alerts #2 and #3 (high) and #4 (moderate). All three affect urllib3 below 2.8.0, and release-requirements.txt pinned 2.7.0.

urllib3 reaches the release lock only through twine -> requests (requests 2.34.2 allows urllib3>=1.26,<3), and the release workflow uses twine only for twine check. The package on PyPI has no runtime dependencies, so installs of recusal were never affected. The lock still should not carry known vulnerable versions.

Change

• urllib3==2.7.0 becomes urllib3==2.8.0, with the sha256 of both files PyPI serves for 2.8.0 (wheel and sdist, released 2026-09-15, not yanked), plus a comment naming the advisories. Nothing else in the lock moves.

Proof

• Locally, on python:3.12-slim: pip install --require-hashes -r release-requirements.txt, then pip check, python -m build --no-isolation, and twine check dist/* (both files PASSED), with urllib3 2.8.0 installed.
• In CI: the required "Hash-locked release environment builds" job runs the same install and build.