fix: raise security dependency floors

[imran-siddique]

What changed

• raise runtime cryptography floor to 50.0
• require aiohttp>=3.14.3 in both the A2A SDK and dev extras
• raise documentation pymdown-extensions floor to 11.0.1
• add regression tests that prevent the vulnerable floors from returning
• record the addressed PYSEC advisories in the changelog

Why

A fresh audit of the existing development environment found nine known vulnerabilities across these packages. The project’s broad minimum constraints allowed the vulnerable releases even though clean installs could select patched versions.

Addressed advisories:

• cryptography: PYSEC-2026-3552, PYSEC-2026-3553, PYSEC-2026-3554
• aiohttp: PYSEC-2026-3545, PYSEC-2026-3546, PYSEC-2026-3547
• pymdown-extensions: PYSEC-2026-3654

Impact

New runtime, A2A SDK, development, and documentation installations cannot resolve the affected versions. This may upgrade existing environments during the next dependency install.

Validation

• clean environment resolved aiohttp 3.14.3 and cryptography 50.0.0
• clean pip-audit: no known vulnerabilities
• dependency-floor tests: 3 passed
• full suite in clean environment: 392 passed, 3 skipped (hardware-only)
• Ruff check and format gate
• mypy strict
• Bandit
• git diff --check
• GitHub Dependabot alerts: none open
• GitHub secret-scanning alerts: none open