fix(security): bump aiohttp, filelock, langchain-core, urllib3, virtualenv

Fixes 15 Dependabot alerts (#1-#15) covering 14 CVEs across five previously-
transitive dependencies. Each is now declared in [project.dependencies] with
a >= floor matching the lockfile version, so `uv lock` pins them at or above
the security-patched versions going forward:

  aiohttp        3.13.2  -> 3.14.1     (CVE-2025-69223..-69230)
  filelock       3.20.0  -> 3.24.2     (CVE-2025-68146, CVE-2026-22701)
  langchain-core 1.1.0   -> 1.3.3      (CVE-2025-68664)
  urllib3        2.5.0   -> 2.7.0      (CVE-2025-66418, -66471, -2026-21441)
  virtualenv     20.35.4 -> 20.39.1    (CVE-2026-22702)

Every CVE package stays within its current major (virtualenv held at latest
20.x, langchain-core at the exact CVE floor) to keep the lockfile change
minimal and avoid major-version breakage in dev tooling.

All five CVE packages have no first-party imports except aiohttp, which
is used only in 3 example/sample files via the stable aiohttp.web /
ClientSession surface (unchanged between 3.13 and 3.14).

Author: jason-anthropic

pyproject.toml

@@ -16,6 +16,11 @@ dependencies = [
     "networkx>=3.6.1",
     "matplotlib>=3.10.8",
     "requests>=2.32.5",
+    "aiohttp>=3.14.1",
+    "filelock>=3.24.2",
+    "langchain-core>=1.3.3",
+    "urllib3>=2.7.0",
+    "virtualenv>=20.39.1",
 ]
 
 [build-system]