security: bump httplib2 to 0.32.0 in uv.lock (GHSA-j5g9-f88f-gfj3)

Dependabot alert #50, high severity: decompression bomb denial of service
via unbounded gzip/deflate response handling in httplib2 < 0.32.0
(CVE-2026-59939).

Transitive, and only through optional extras: the gemini and all extras pull
google-generativeai, which pulls google-api-python-client, which pulls
httplib2. Nothing in the core dependency set touches it.

Practical exposure is limited. The published package declares
google-generativeai>=0.8.0 and pins nothing below it, so anyone installing
from PyPI already resolves httplib2 >= 0.32.0. This lockfile governs our own
CI and dev environment, not users. Fixing it anyway because CI runs with it
and the fix is three lines.

Applied by hand rather than with `uv lock --upgrade-package httplib2`. The
local uv is 0.6.5, older than whatever wrote this lockfile: running it
rewrote the file to revision 1 and STRIPPED the upload-time field from all
1949 entries, a 1960-line diff that discards supply-chain provenance to fix
one CVE. Reverted that and edited the single package block instead.

The three replacement values were taken from the PyPI JSON API for
httplib2 0.32.0 and verified back against it after editing: both artifact
sha256 hashes, both sizes, and both URLs match. Dependency set is unchanged
(pyparsing). revision = 3 and all 1949 upload-time fields are preserved.
Diff is 3 insertions, 3 deletions.

Two pre-existing conditions found while verifying, neither introduced here
and neither fixed here:

- `uv lock --check` already failed on unmodified HEAD, so it is not a usable
  gate for this change on this machine.
- The lockfile records jcodemunch-mcp 1.108.158 while pyproject.toml is at
  1.108.176, so nothing re-locks on release and the project's own version has
  been stale in it for 18 releases.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jgravelle