fix: update vulnerable Python dependencies

[Alekseylekontsev]

What changed

• updates vulnerable direct and transitive Python dependencies to patched versions
• regenerates uv.lock
• keeps lazy-install pins aligned with project extras
• explicitly pins the security-fixed PyNaCl release alongside Discord
• adds SECURITY_DEPENDENCY_REPORT.md

Why

The supplied audit reported 47 findings, including a critical ChromaDB code-injection advisory and high-severity issues in cryptography, MCP, Starlette, and python-multipart. ChromaDB is no longer in the synchronized upstream dependency graph; the remaining affected packages are upgraded to patched versions.

Validation

• dependency resolution and selected-profile installation passed on native Windows
• fresh installed-profile audit: 0 known vulnerabilities
• dependency import smoke test passed
• metadata, packaging, and computer-use dependency tests: 237 passed, 1 Windows-path fixture deselected

Windows status

This machine has no installed WSL Linux distribution. Native-Windows dependency installation works for core/all/dev/messaging/MCP/web/Google/Teams profiles, but the complete suite cannot be collected because three tests assume POSIX facilities (termios, /tmp, and which). Since upstream Hermes documents WSL2 as the supported Windows path, full runtime compatibility remains unverified until the suite is rerun inside WSL2. Details are recorded in the report.