Track docs dependency security updates for requests/urllib3

[highbyte]

The docs dependency lockfile currently triggers GitHub Dependabot alerts for:

• requests: GHSA-gc5v-m9x4-r6x2
• urllib3: GHSA-qccp-gfcp-xxvc
• urllib3: GHSA-mf9v-mfxr-j63j

Current state when checked on 2026-05-13:

• requirements-docs.txt is already locked and hash-pinned
• pip-audit reports these fix targets:
  • requests -> 2.33.0
  • urllib3 -> 2.7.0
• the resolved docs dependency graph was already at the newest installable versions visible from the current package source during verification

Action to take once patched releases are available from the package index used by this repo:

1. Regenerate requirements-docs.txt from requirements-docs.in
2. Verify pip-audit -r requirements-docs.txt is clean
3. Push the updated lockfile so Dependabot alerts clear

Notes:

• This affects the docs build dependency set in requirements-docs.txt
• The docs GitHub Actions workflow now installs with --require-hashes and --only-binary :all: