fix(security): bump pytest to 9.0.3 to clear CVE-2025-71176

The Dependency Audit job flagged pytest 8.4.2 in
compliance/requirements.lock.txt as vulnerable to CVE-2025-71176, fixed in
9.0.3. Bump the pinned version and the requirements.txt lower bound. SDK
tests and the schema compliance suite both pass on pytest 9.0.3, and
`pip-audit` against all three lock files (reference, compliance, docs)
now reports no known vulnerabilities.

Made-with: Cursor

Author: LarFii

compliance/requirements.lock.txt

@@ -4,4 +4,4 @@ PyYAML==6.0.3
 httpx==0.28.1
 jsonschema==4.26.0
 pymysql==1.1.2
-pytest==8.4.2
+pytest==9.0.3

compliance/requirements.txt

@@ -1,4 +1,4 @@
-pytest>=8.0
+pytest>=9.0
 httpx>=0.28
 jsonschema>=4.23
 PyYAML>=6.0