add urllib3 exclusions to dependency review

Author: bmos

.github/workflows/dependency-review.yml

@@ -25,4 +25,7 @@ jobs:
 
       - uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261
         with:
-          allow-ghsas: GHSA-pq67-6m6q-mj2v  # urllib3
+          allow-ghsas: >
+             GHSA-pq67-6m6q-mj2v  # urllib3 < 2.5.0 (remove when python 3.9 is removed)
+             GHSA-gm62-xv2j-4w53  # urllib3 < 2.6.0 (remove when python 3.9 is removed)
+             GHSA-2xpw-w6gg-jr37  # urllib3 < 2.6.0 (remove when python 3.9 is removed)