chore(tests): refresh fixture lockfiles to patched dependency versions

[MAfarrag]

Context

GitHub Dependabot reported 107 open alerts on main (1 critical, 41 high, 54 medium, 11 low). Every alert is in a
committed test-fixture lock file (tests/data/**/uv.lock) or the one requirements.txt — the pinned dependency
trees of the minimal projects that exercise the composite actions in CI. Fixed in PR #40.

Problem / Current Behaviour

The fixtures pin old versions of docs/jupyter/HTTP tooling (urllib3, idna, requests, mistune, jupyter-server,
tornado, jupyterlab, bleach, pygments, …) that have since had CVEs. The composite actions bundle no
dependencies, so nothing reaches consumers — but the alerts inflate the Security tab, and the fixtures must keep
committed locks (the actions consume them via uv sync --frozen), so the locks can't just be deleted.

Affected locations

File(s)	Note
14 x tests/data/**/uv.lock	fixture dependency trees
tests/data/pip/test-pip-cache-with-requirements/requirements.txt	requests pin

Proposed Solution

Surgical uv lock --upgrade-package for only the flagged packages (leaving commitizen/mkdocs at tested
versions); bump requests in the requirements.txt. Patched versions include the critical jupyter-server 2.20.0,
urllib3 2.7.0, requests 2.34.2, idna 3.18, pygments 2.20.0.

Out of Scope

• No composite action / workflow / script changed.
• 3 alerts (a jupyter-server, bleach, mistune CVE) have no upstream fix and cannot be resolved by any
  upgrade; they persist until upstream releases a patch.

Effort Estimate

Size: S — one file per fixture, plus CI re-verification.

Definition of Done

• Flagged packages at >= their patched versions across all fixture locks (104/107 alerts cleared on re-scan)
• commitizen/mkdocs unchanged; every lock consistent with its pyproject.toml
• CI green (test-mkdocs-deploy, test-release/github, test-python-setup/*)