Fix reported dependency vulnerabilities

[johnnygreco]

Summary

• Raise the Reachy project's anyio and cryptography minimums to the report's patched versions and regenerate uv.lock.
• Document the Go golang.org/x/crypto advisory as an unfixed openpgp package finding; the exporter's compiled dependency graph does not include openpgp.

Validation

• uv lock --check — passed.
• go mod verify — passed.
• go vet ./... — passed.
• go build ./cmd/... — passed.
• go test -race -p 1 ./... — passed.
• Reachy test suite — unavailable on this Linux host because the committed lock supports macOS only.

The attached report does not include advisory IDs. The Go assessment is based on the published GO-2026-5932 advisory and go list -deps ./....