fix(deps): bump gitpython and urllib3 to resolve HIGH security alerts (#4283)

- git: gitpython >=3.1.45 -> >=3.1.50 (lock 3.1.49 -> 3.1.50)
  Fixes GHSA-mv93-w799-cj2w: newline injection in config_writer()
  bypasses the CVE-2026-42215 patch, enabling RCE via core.hooksPath.
- fetch: urllib3 2.6.3 -> 2.7.0 (transitive via requests)
  Fixes GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins
  on proxied redirects) and GHSA-mf9v-mfxr-j63j (decompression-bomb
  safeguards bypassed in the streaming API).

Resolves Dependabot alerts #129, #131, #132.
Tests pass (fetch: 20 passed; git: all test bodies pass, only
pre-existing Windows tmpdir-teardown errors remain).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: olaservo

src/fetch/uv.lock

@@ -17,7 +17,7 @@ classifiers = [
 ]
 dependencies = [
     "click>=8.1.7",
-    "gitpython>=3.1.45",
+    "gitpython>=3.1.50",
     "mcp>=1.0.0",
     "pydantic>=2.0.0",
 ]