chore(deps)(deps): bump x402 from 0.2.0 to 2.8.0 in /python/x402_a2a - #117

* chore(ci-deps): bump github-actions group (google-agentic-commerce#111)

- astral-sh/setup-uv v5.4.2/v6 -> v8.1.0
- pypa/gh-action-pypi-publish v1.12.4 -> v1.14.0
- googleapis/release-please-action v4 -> v5

* chore(deps): batch safe dependency updates for x402_a2a

Combines these upstream Dependabot PRs into one re-locked batch:
- google-agentic-commerce#112 pydantic 2.11.7 -> 2.13.4 (prod group)
- google-agentic-commerce#113 dev group: mypy 1.18.2->1.20.2, pytest-mock 3.14.1->3.15.1, ruff 0.13.1->0.15.13, trio 0.30.0->0.33.0
- google-agentic-commerce#115 pytest-cov 6.2.1 -> 7.1.0
- google-agentic-commerce#122 aiohttp 3.13.4 -> 3.14.0
- google-agentic-commerce#108 idna 3.10 -> 3.15
- google-agentic-commerce#106 protobuf 6.32.0 -> 6.33.5
- google-agentic-commerce#100 pyasn1 0.6.1 -> 0.6.3
- google-agentic-commerce#103 pygments 2.19.2 -> 2.20.0
- google-agentic-commerce#105 requests 2.32.4 -> 2.33.0
- google-agentic-commerce#104 werkzeug 3.1.3 -> 3.1.6
- google-agentic-commerce#96 urllib3 2.5.0 -> 2.7.0
- google-agentic-commerce#101 flask 3.1.1 -> 3.1.3

Re-locked with uv; pytest (3 passed) and ruff check/format pass.
Excludes majors x402 2.8.0 (google-agentic-commerce#117), a2a-sdk 1.0.2 (google-agentic-commerce#114), starlette 1.0.1 (google-agentic-commerce#123).

* chore(deps): batch safe dependency updates for adk-demo

Combines upstream Dependabot PRs:
- google-agentic-commerce#116 adk-demo-safe group: google-adk 1.14.1->1.33.0, click 8.2.1->8.3.3,
  uvicorn 0.35.0->0.46.0, web3 7.10.0->7.16.0, cdp-sdk 1.32.0->1.46.0,
  ruff 0.13.1->0.15.12, plus transitive cascade
- google-agentic-commerce#118 pytest-cov: obviated (google-adk 1.33 no longer pulls pytest-cov)

Re-locked with uv (181 packages); uv sync --group lint and ruff check/format pass.

* chore(deps): bump starlette 0.47.2 -> 1.0.1 in x402_a2a (google-agentic-commerce#123)

The one upstream major that re-locks and passes cleanly on top of the safe
batch. uv resolves starlette 1.0.1 without bumping a2a-sdk 0.3.1, i.e. a2a-sdk
0.3.1 already declares compatibility with starlette 1.0; package import, the
test suite (3 passed), and ruff check/format all pass.

Transitively pulls fastapi 0.116.1 -> 0.136.3 plus annotated-doc, fastar and
pydantic-extra-types.

Four of the bumps this PR consolidated were superseded while it sat open.
Re-locked to the versions Dependabot now proposes, and picked up one new
safe PR (google-agentic-commerce#131).

python/x402_a2a:
  aiohttp          3.14.0 -> 3.14.3   (google-agentic-commerce#160, supersedes google-agentic-commerce#122)
  pyasn1           0.6.3  -> 0.6.4    (google-agentic-commerce#154, supersedes google-agentic-commerce#100)
  python-multipart 0.0.27 -> 0.0.31   (google-agentic-commerce#131, new)
  pytest           9.0.3  -> 9.1.0    (google-agentic-commerce#135, supersedes google-agentic-commerce#113)
  pytest-asyncio   1.3.0  -> 1.4.0    (google-agentic-commerce#135)
  ruff             0.15.13 -> 0.15.18 (google-agentic-commerce#135)

python/examples/adk-demo:
  click     8.3.3  -> 8.4.1   (google-agentic-commerce#147, supersedes google-agentic-commerce#116)
  uvicorn   0.46.0 -> 0.49.0  (google-agentic-commerce#147)
  cdp-sdk   1.46.0 -> 1.47.1  (google-agentic-commerce#147)
  ruff      0.15.12 -> 0.15.18 (google-agentic-commerce#147)

pytest-mock, trio and web3 were already at or above the new targets.

The ruff floor is now 0.15.18 in both pyproject.toml files, resolving the
inconsistency flagged in review (adk-demo had >=0.15.12 against
x402_a2a's >=0.15.13) and matching the version pinned in CI.

Majors remain excluded: starlette (google-agentic-commerce#133), x402 (google-agentic-commerce#117), a2a-sdk (google-agentic-commerce#114).