fix: bump vulnerable transitive dependencies to patched versions

Address open Dependabot alerts by pinning minimum safe versions:
- gitpython 3.1.47 → 3.1.50 (high: RCE via newline injection in config_writer())
- idna 3.10 → 3.18 (medium: bypass of CVE-2024-3651 fix in idna.encode())
- pymdown-extensions 10.21.2 → 10.21.3 (medium: path traversal in snippets)

Floor constraints added to pyproject.toml to prevent regression on lock regeneration.

Author: b-per

pyproject.toml

@@ -50,6 +50,13 @@ mkdocs = [
     "mkdocs-material>=9.6.3",
     "mike>=2.1.3",
     "mkdocs-git-revision-date-localized-plugin>=1.3.0",
+    "gitpython>=3.1.50",  # CVE: RCE via newline injection in config_writer()
+    "pymdown-extensions>=10.21.3",  # CVE: path traversal bypass in snippets
+]
+
+[tool.uv]
+constraint-dependencies = [
+    "idna>=3.15",  # CVE: bypass of CVE-2024-3651 fix in idna.encode()
 ]
 
 [tool.pdm.build]