Bump the locked versions of eight dev and test dependencies

Refreshes only uv.lock; the declared ranges in pyproject.toml are unchanged,
so this affects CI and contributor environments, not what users install.

- cryptography 46.0.7 -> 50.0.0
- pillow 12.1.1 -> 12.3.0
- pyjwt 2.10.1 -> 2.13.0
- pytest 8.4.2 -> 9.1.1
- python-dotenv 1.1.1 -> 1.2.3
- python-multipart 0.0.22 -> 0.0.32
- starlette 0.49.1 -> 1.6.0
- urllib3 2.6.3 -> 2.7.0

These are the pins Dependabot currently has open alerts against. The
individual Dependabot PRs for them were closed unmerged, which leaves
Dependabot treating each target version as already handled, so they are
bumped here by hand with `uv lock --upgrade-package`.

Starlette 1.x makes `Request` generic over its state type, so one test
handler now parametrizes its `ServerRequestContext` annotation instead of
narrowing `ctx.request` from `Any` with `isinstance`, which pyright reports
as `Request[Unknown]`.

Author: maxisbey

tests/shared/test_streamable_http.py

@@ -1405,7 +1405,9 @@ async def _handle_context_list_tools(
     )
 
 
-async def _handle_context_call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) -> CallToolResult:
+async def _handle_context_call_tool(
+    ctx: ServerRequestContext[Any, Request], params: CallToolRequestParams
+) -> CallToolResult:
     assert params.name in ("echo_headers", "echo_context")
     assert isinstance(ctx.request, Request)