deps: update locked urllib3 to 2.8.0

[mcdigman]

Summary

Update locked urllib3 from 2.7.0 to 2.8.0, the patched version for GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, and GHSA-gh4c-6fx4-qh6g. This is a transitive dependency of the optional docs extra through Sphinx and requests.

The diff changes only uv.lock's version, sdist, and wheel records for urllib3; no other package version changes.

Verification

• uv lock --check --offline passed.
• Locked Python 3.14 docs installation selected urllib3==2.8.0.
• sphinx-build -W --keep-going -b html docs ... passed.
• git diff --check and commit hooks passed.
• All PR checks passed except Skylos. The failed Skylos run used v4.43.2 and reports 11 SKY-D223 findings. Running v4.43.2 on unchanged main commit 6e8cc0f reproduces the same 11 findings and exit code 1. The last passing main run used v4.43.0.