fix(deps): resolve CVEs in Python and docsite dependencies - #257

Summary

• Python: raised floors for pillow (13), filelock (4.2.1), tornado (6.6.1), pyasn1 (0.6.5), langgraph (1.2.20); added overrides for certifi, oauthlib (4.0.1), dnspython, opentelemetry-api, setuptools. Fixed releases need Python >=3.11, so these use python_version markers.
• Capped snowflake-connector-python<5 (5.x breaks snowpark).
• Docsite: bumped overrides for serialize-javascript, qs, body-parser, follow-redirects, joi. npm audit goes from 26 to 5 low advisories.

Not resolved

• mariadb 1.1.14 (PYSEC-2026-217): no patched release.
• deepmerge (#368, low): no patched release; build-time only.
• Python 3.10 lock entries stay on older, likely vulnerable versions of the packages above. Consider raising requires-python to >=3.11.

Testing

• pip-audit on the lock: only mariadb remains. Docsite npm run build succeeds.
• tests/adapters and key-identification tests pass; ruff check src/ unchanged from main (8 existing errors).
• tests/mcp does not collect (existing mcp import error, unrelated to this change). Streamlit app and Databricks adapter not manually tested.

🤖 Generated with Claude Code