chore(release): bump spiffe to 0.3.1

[maxlambrecht]

What

Prepare the spiffe 0.3.1 patch release:

• spiffe/pyproject.toml: version 0.3.0 → 0.3.1
• spiffe/CHANGELOG.md: dated [0.3.1] section covering the two changes merged since 0.3.0
• uv.lock: workspace version refresh

No spiffe-tls release: it has no changes since 0.4.0, and its spiffe>=0.3.0,<0.4.0 requirement already resolves to 0.3.1.

Why

Two user-visible changes have landed since 0.3.0 and are unreleased:

• Fix FFDH CryptographyDeprecationWarning raised when importing spiffe #446 — importing spiffe raises CryptographyDeprecationWarning (FFDH) at import time under cryptography 50. Because that warning subclasses UserWarning, downstream projects using filterwarnings = error cannot import spiffe at all.
• Disable 'iat' field verification #443 — JwtSvid.parse_and_validate() no longer verifies the optional iat claim, so valid SVIDs are not rejected when issuer and validator clocks differ.

Patch rather than minor: neither change adds API surface, and both are backward-compatible fixes. Keeping the release in the 0.3.x line also matters here, since a 0.4.0 would fall outside spiffe-tls's <0.4.0 requirement and outside any downstream cap, which would block exactly the consumers this release is meant to unblock.

How tested

• ./dev lint — clean (ruff/mypy/pyright, 100% type completeness)
• ./dev test — 376 passed (spiffe), 20 passed (spiffe-tls)
• ./dev build — spiffe-0.3.1 sdist/wheel build with correct metadata
• ./dev integration — not run locally (no SPIRE agent socket); covered by CI, which starts SPIRE
• Verified the fix against the actual failure mode, which CI does not cover (it resolves cryptography 46 via uv.lock):
  • spiffe==0.3.0 + cryptography 50.0.0, python -W error::UserWarning -c "import spiffe" → fails with CryptographyDeprecationWarning at certificate_utils.py:56
  • the built spiffe-0.3.1 wheel, same command → imports cleanly