deps: refresh uv.lock for Dependabot advisories

Full `uv lock --upgrade`. Clears every open Dependabot alert except the
aiohttp ones, which are blocked upstream (see below). Notable security-
relevant bumps:

  cryptography 46.0.5 -> 49.0.0   (GHSA-537c-gmf6-5ccf, high)
  pyarrow      23.0.0 -> 24.0.0   (GHSA-rgxp-2hwp-jwgg, high)
  pyjwt        2.12.1 -> 2.13.0   (high; via azure-identity -> msal)
  urllib3      2.6.3  -> 2.7.0    (high)
  lxml         6.0.2  -> 6.1.1    (high, dev-only)
  black        26.1.0 -> 26.5.1   (high, dev-only; via pytest-examples)
  idna         3.11   -> 3.18     (medium)
  pytest       9.0.2  -> 9.1.0    (medium)

Also pulls forward mypy (1.19 -> 2.1), ruff, typer, rich, etc. The ruff
bump's new UP047 required migrating tests/test_protocol_classes.py's
ipc_round_trip to a PEP 695 generic.

aiohttp stays at 3.13.5: vgi-rpc's `external` extra caps it `<3.14`, and
all the aiohttp advisories are patched only in >=3.14. Lifting that cap is
tracked in vgi-rpc (the blocker is the aioresponses test mock, not vgi-rpc
runtime code).

mypy + ruff clean; pytest 1951 passed; make test_launcher 205/206 (the
bool_in_union failure pre-exists on main).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rustyconover

tests/test_protocol_classes.py

@@ -7,7 +7,7 @@
 
 from __future__ import annotations
 
-from typing import TypeVar, get_args, get_origin, get_type_hints
+from typing import get_args, get_origin, get_type_hints
 
 import pyarrow as pa
 import pytest
@@ -28,10 +28,8 @@
 )
 from vgi.table_function import TableCardinality
 
-T = TypeVar("T")
 
-
-def ipc_round_trip(obj: T, cls: type[T]) -> T:
+def ipc_round_trip[T](obj: T, cls: type[T]) -> T:
     """Serialize an object and deserialize via IPC stream."""
     batch, metadata = deserialize_record_batch(obj.serialize_to_bytes())  # type: ignore[attr-defined]
     return cls.deserialize_from_batch(batch, metadata)  # type: ignore[attr-defined, no-any-return]