fix(deps): patch high-severity CVEs in python-multipart, protobuf, lxml, and npm packages (#5775)

## Summary
- Bump `python-multipart` constraint from `>=0.0.22` to `>=0.0.27` to
fix CVE-2026-40347 (header injection) and CVE-2026-42561 (DoS via
oversized headers)
- Add `protobuf>=5.29.6` constraint to fix CVE-2025-4565 and
CVE-2026-0994 (parsing vulnerabilities)
- Add `lxml>=6.1.0` constraint to fix CVE-2026-41066 (XML entity
expansion with default config)
- Run `npm audit fix` in `src/ogx_ui` to resolve high-severity
advisories in flatted, glob, minimatch, picomatch, and preact

## Test plan
- [ ] Verify `uv run --with pip-audit pip-audit` shows no high-severity
Python CVEs
- [ ] Verify `cd src/ogx_ui && npm audit` shows no high-severity issues
- [ ] Run unit tests: `uv run pytest tests/unit/ -x --tb=short`
- [ ] Verify no import breakage from protobuf 5.x → 6.x in OpenTelemetry
usage

---------

Signed-off-by: Sébastien Han <seb@redhat.com>
Co-authored-by: multica-agent <github@multica.ai>

Author: leseb

pyproject.toml

@@ -16,9 +16,11 @@ constraint-dependencies = [
     "h11>=0.16.0",
     "litellm<1.83.7",                   # >=1.83.7 pins pydantic==2.12.5 which breaks int coercion in openai model recordings
     "pydantic>=2.11.9,<2.12.0",        # 2.12 breaks int coercion in openai.types.model.Model during test replay
+    "lxml>=6.1.0",                     # CVE-2026-41066: XML entity expansion with default resolve_entities=True
     "pillow>=12.2.0",                  # CVE-2026-40192 + 4 more: heap overflow, OOB write, DoS
+    "protobuf>=5.29.6",               # CVE-2025-4565 + CVE-2026-0994: parsing vulnerabilities
     "pyasn1>=0.6.3",                   # CVE-2026-30922: DoS via unbounded recursion
-    "python-multipart>=0.0.22",
+    "python-multipart>=0.0.27",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
     "python-socketio>=5.14.0",         # CVE-2025-61765: RCE via pickle deserialization
     "starlette>=0.49.1",
     "tornado>=6.5.5",