deps: bump urllib3 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, GHSA-vxq7-64xx-v4gw)

[katsugtgz]

Updates urllib3 to address GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, and GHSA-vxq7-64xx-v4gw.

Evidence:

• requirements.txt pinned urllib3==2.6.3
• OSV reports the three advisories above for urllib3@2.6.3 (all fixed in 2.8.0)
• updated version: 2.8.0

Validation:

• fresh venv install of requirements.txt and requirements-web.txt succeeds with urllib3 2.8.0
• python -m pytest -q --ignore=tests/test_gui_layout.py: 290 passed, 1 failed
• the single failure (web/server.py::test_outlook_mailboxes, async test collected without pytest-asyncio) also fails on the unmodified main branch, so it predates this change
• pip-audit --requirement requirements.txt --no-deps no longer reports any urllib3 advisory
• pip-audit still reports unrelated pins (filelock 3.19.1, idna 3.13, requests 2.32.5) with their own advisories; this patch only clears the urllib3 ones

Scope: requirements.txt one-line pin change only.

[AaronL725]

Thanks for the contribution. We’re keeping Python 3.9 compatibility for now, while urllib3 2.8.0 requires Python 3.10+, so this change can’t be merged in its current form. Closing for now.