security: replace advocate with champion and upgrade urllib3 to 2.x

[wtfiwtz]

Summary

Replace deprecated advocate with champion and upgrade urllib3 to 2.x in one PR, so ENFORCE_PRIVATE_ADDRESS_BLOCK is never left without an SSRF implementation.

Rebased onto current master after #7755 (Poetry → uv) and #7768 (Authlib stack). Supersedes #7745 (closed).

Dependency changes

• Remove advocate==1.0.0
• urllib3: 1.26.19 → 2.7.0
• boto3 / botocore: 1.28.8 / 1.31.8 → 1.43.7
• Add optional uv dependency group ssrf with champion pinned to git rev 74cf301

Code / settings

• requests_or_advocate → requests_or_champion
• ENFORCE_PRIVATE_ADDRESS_BLOCK default: true → false (opt-in; requires champion install)

Enable SSRF protection

1. Set REDASH_ENFORCE_PRIVATE_IP_BLOCK=true
2. Install champion: uv sync --group ssrf (or add ssrf to Dockerfile install_groups)

What type of PR is this?

• Other (security dependency upgrade)

How is this tested?

• Unit tests (pytest, jest)
• E2E Tests (Cypress)
• Manually
• N/A

Related

• Closes / supersedes security: upgrade urllib3 to 2.7.0 and AWS SDK for compatibility #7745
• Suggested after security: upgrade to Werkzeug 3.1.6 on Flask 2.3.3 #7719 (Werkzeug 3); independent of Flask 3

[wtfiwtz]

Rebased onto current master (uv + #7768). Converted the Poetry ssrf group to a uv dependency-groups.ssrf pin and regenerated uv.lock. #7745 is closed so this is the single urllib3 2.x + champion landing path.