security: bump urllib3 to >=2.7.0

Mitigate decompression-bomb safeguard bypass in urllib3 2.6.x streaming API.
Add constraint so future lockfiles cannot regress below 2.7.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: dantetemplar

pyproject.toml

@@ -39,6 +39,7 @@ mongo = ["beanie>=1.30.0,<2", "motor>=3.7.1,<4"]
 
 [tool.uv]
 default-groups = ["mongo"]
+constraint-dependencies = ["urllib3>=2.7.0"]
 
 [tool.ruff]
 line-length = 120