fix(deps): bump aiohttp and pyjwt constraints for CVE-2026-34993 and CVE-2026-48526 (backport #6183) (#6223)

## Summary

Backport of #6183 to `release-0.7.x`.

Bump minimum versions for aiohttp and pyjwt to address active CVEs:

| Package | Old Constraint | New Constraint | CVE |
|---|---|---|---|
| `aiohttp` | `>=3.13.3` | `>=3.14.0` | CVE-2026-34993: arbitrary code
execution via `CookieJar.load()` |
| `pyjwt[crypto]` | `>=2.12.0` | `>=2.13.0` | CVE-2026-48526:
authentication bypass via forged JWTs |

## Test plan

- [x] `uv run pre-commit run --all-files` — all checks passed (skipped
`api-conformance` due to Go version mismatch in local env)
- [ ] Verify updated package versions resolve in clean install

Signed-off-by: Eleanor Hu <ehu@redhat.com>
Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Charlie Doern <cdoern@redhat.com>

Author: 3 people

pyproject.toml

@@ -32,7 +32,7 @@ classifiers = [
 ]
 dependencies = [
     "PyYAML>=6.0",
-    "aiohttp>=3.13.3",
+    "aiohttp>=3.14.0",                                  # CVE-2026-34993: CookieJar.load() RCE
     "fastapi>=0.115.0,<1.0",                          # server
     "fire",                                           # for MCP in LLS client
     "httpx",
@@ -42,7 +42,7 @@ dependencies = [
     "openai>=2.5.0",
     "prompt-toolkit",
     "python-dotenv>=1.2.2",                           # CVE-2026-28684: arbitrary file overwrite via symlink following
-    "pyjwt[crypto]>=2.12.0",                          # Pull crypto to support RS256 for jwt. Requires 2.12.0+ to fix CVE-2026-32597.
+    "pyjwt[crypto]>=2.13.0",                          # Pull crypto to support RS256 for jwt. CVE-2026-48526: auth bypass via forged JWTs.
     "pydantic>=2.11.9",
     "rich",
     "structlog>=24.1.0",