chore(evaders): bump h2 and setuptools in the lockfiles to clear open dependabot alerts

Both are transitive, so they need a lockfile bump rather than a pyproject change:

  - h2 4.3.0 -> 4.4.1 (evaders/vanilla) — duplicate Host header could facilitate
    request smuggling. Pulls hpack 4.1.0 -> 4.2.0 with it.
  - setuptools 81.0.0 -> 84.0.0 (evaders/arena-solver-ocr) — MANIFEST.in
    exclusion bypass in sdist via Unicode NFC/NFD collision on macOS APFS/HFS+.
    Advisory needs >=83.0.0.

The pillow (<12.3.0, 13 alerts) and torch (<=2.12.1) alerts on this lock are
already covered by fb91544 earlier on this branch; they close when it lands.

Author: datascry