fix(deps): resolve dependabot vulnerability notifications

[dandye]

Summary

Resolves 13 Dependabot security vulnerability alerts on chronicle/logstory by upgrading dependencies in uv.lock and src/logstory/requirements.txt:

• urllib3: Upgraded 2.7.0 -> 2.8.0 in src/logstory/requirements.txt and uv.lock
  • CVE-2026-97687 (High): HTTPS proxy TLS configuration may be ignored or overridden
  • CVE-2026-97688 (Medium): Chunked Deflate streaming can enter an infinite loop
  • CVE-2026-97689 (High): HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
• oauthlib: Upgraded 3.3.1 -> 4.0.0 in src/logstory/requirements.txt and uv.lock
  • CVE-2026-49264 (Medium): Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
  • CVE-2026-49265 (Medium): Timing Attack Vulnerability in PKCE code_verifier Comparison
• virtualenv: Upgraded 21.7.4 -> 21.12.1 in uv.lock
  • CVE-2026-102930 (High): Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
  • CVE-2026-102938 (Medium): Unsanitized line boundaries in pyvenv.cfg prompt values allowing configuration injection
• black: Upgraded 25.12.0 -> 26.5.1 (via pyink 26.5.1) in uv.lock
  • CVE-2026-32274 (High): Arbitrary file writes from unsanitized user input in cache file name

Verification

• uv sync --all-extras: Completed successfully with all updated dependencies installed.
• uv run pytest: 175/175 tests passed.
• uv run pytest --cov=logstory: 83.47% test coverage (exceeds 80% requirement).
• uv run ruff check .: All checks passed.
• uv run pyink --check src tests: 24 files left unchanged.
• CHANGELOG.md: Updated with security release notes.