Update urllib3 to 2.7.0

[katsugtgz]

Updates urllib3 to address the advisories listed below.

Evidence:

• requirements.txt pinned urllib3==2.2.2
• OSV reported 12 advisories at 2.2.2 (GHSA-pq67-6m6q-mj2v, GHSA-qccp-gfcp-xxvc, GHSA-gm62-xv2j-4w53, GHSA-48p4-8xcf-vxj5, GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, PYSEC-2026-141, PYSEC-2026-1994/1996/1997/1998/1999), incl. the HIGH redirect-handling advisory GHSA-pq67-6m6q-mj2v
• updated version: 2.7.0, lowest release with zero OSV advisories for this package (2.2.3 through 2.6.4 each still match at least one)

Validation:

• OSV query returns no advisories for urllib3 2.7.0
• pip install -r requirements.txt resolves clean on Python 3.12 and pip check passes
• mkdocs build --strict completes (documentation built in 19.6s); the pre-existing absolute-link INFO lines are identical on master, verified by building both

Scope: requirements.txt pin only.

[katsugtgz]

Follow-up: GHSA-chx6-46f5-w4vp, GHSA-c2m8-h5v5-343r, and GHSA-3hv7-mjh2-fv65
were published after these PRs were opened and all three affect tornado 6.5.8.
The pins now sit at 6.5.9, which clears all three per OSV. The urllib3 bumps
moved to 2.8.0 for the same reason (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g,
GHSA-vxq7-64xx-v4gw affect 2.7.0). Sorry for the churn.