Refresh the lock and move osv-scanner to v2.7.0

[vvillait88]

Summary

Routine dependency refresh.

• uv lock --upgrade moves seven transitive packages: aiohttp 3.14.5, bitarray 3.12.1, google-auth 2.62.0, pycryptodome 3.24.1, pydantic 2.14.1, pydantic-core 2.50.1 and sentry-sdk 2.72.0. No declared range changes.
• The dependency scan's pinned osv-scanner binary moves from v2.6.0 to v2.7.0 in .github/workflows/security.yml. Dependabot does not track a binary downloaded by URL, and the release asset name is unchanged.

The web3<8 constraint stays: pympp 0.11.0 still requires eth-abi<6.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. The lockfile does not ship in the wheel, so the published package is unchanged and no release is owed.

Test plan

Run locally after uv sync --all-extras --all-groups:

• ruff check, ruff format --check and ty check all pass, and vulture . --min-confidence 80 --exclude .venv passes;
• pytest: 1673 passed, 4 skipped, coverage 97.44% against the 95% floor.

The only prerelease in the lock is OpenTelemetry's semantic-conventions (0.66b1), which is beta-tagged by design.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests