set urlib above 2.5.0 to address safety lint issue

[rbavery]

Description

addresses https://github.com/stac-extensions/mlm/actions/runs/16453896381/job/46505885997

Related Issue

Type of Change

• 📚 Examples, docs, tutorials or dependencies update;
• 🔧 Bug fix (non-breaking change which fixes an issue);
• 🥂 Improvement (non-breaking change which improves an existing feature);
• 🚀 New feature (non-breaking change which adds functionality);
• 💥 Breaking change (fix or feature that would cause existing functionality to change);
• 🔐 Security fix.

Checklist

• I've read the CONTRIBUTING.md guide;
• I've updated the CHANGELOG.md with provided changes;
• I've updated the README.md and/or best-practices.md as applicable with new features;
• I've updated the code style using make check;
• I've written tests for all new methods and classes that I created;
• I've written the docstring in Google format for all the methods and classes that I used.

[fmigneault]

I think it applies only to dev dependencies?
I did similar for requests recently: https://github.com/stac-extensions/mlm/pull/107/files