security: bump urllib3 to 2.7.0 to fix HIGH advisories (#18)

Resolves two HIGH Dependabot alerts (both patched in 2.5.0+):
- Decompression-bomb safeguards bypassed in parts of the streaming API
  (GHSA-48p4-8xcf-vjwc / CVE-2025-50181)
- Sensitive headers forwarded across origins in proxied low-level redirects
  (GHSA-pq67-6m6q-mj2v / CVE-2025-50182)

Non-breaking same-major bump: 2.6.3 -> 2.7.0.

Author: mayurrawte

requirements.txt

@@ -19,6 +19,6 @@ rfc3986==2.0.0
 six==1.16.0
 tqdm==4.66.3
 twine==4.0.2
-urllib3==2.6.3
+urllib3==2.7.0
 webencodings==0.5.1
 zipp==3.19.1