Remove upper bound on cryptography

[woodruffw]

This upper bound is pretty disruptive to integrators/downstream packagers. I think we originally added it for strict semver reasons, but:

1. cryptography does not use semver uses the one true versioning scheme (of making regular semantically breaking releases);
2. Our use of their APIs is not high-risk for breakage;
3. cryptography itself integrates sigstore-python's tests as an integration signal, meaning it won't break us unexpectedly.

See Homebrew/homebrew-core#287851 for context.

Closes #1809

[jku]

💯