chore(deps): constrain PyJWT>=2.15.0 to resolve dependabot alerts (#196)

Address open dependabot security alerts against the root uv.lock:

- PyJWT 2.13.0 -> 2.15.0: fixes 10 advisories including the critical
  asymmetric-PEM detection bypass, JWKS redirect following, DER-keys-as-
  HMAC-secrets, and the RecursionError DoS (first patched in 2.15.0).

PyJWT is a transitive dependency, so it is pinned via
tool.uv.constraint-dependencies rather than added to project dependency
lists. uv.lock rebuilt with 'uv lock'; no other packages changed.

urllib3 (2.8.0, #192), anyio (4.14.2), cryptography (49.0.0), and hpack
(4.2.0) alerts are already resolved at their locked versions. Alerts
against deleted per-plugin uv.lock manifests are stale and will close on
the next dependabot scan.

Signed-off-by: Jonathan Springer <jps@s390x.com>

Author: jonpspri

pyproject.toml

@@ -11,10 +11,12 @@ constraint-dependencies = [
     "maturin>=1.13.3,<2.0",
     "mcp>=2.0.0",
     "pydantic>=2.13.5,<3",
+    "PyJWT>=2.15.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=1.3.0",
     "PyYAML>=6.0.3",
     "redis>=7.4.0",
+    "urllib3>=2.8.0",
 ]
 build-constraint-dependencies = [
     "maturin>=1.13.3,<2.0",