Chore(deps): Fix multiple CVEs in dev and docs dependencies

Address open security alerts:
- serialize-javascript RCE + DoS: force ^7.0.7 via overrides (mocha pins 6.0.2)
- pygments GUID ReDoS: 2.19.1 -> 2.20.0
- requests extract_zipped_paths temp file reuse: 2.32.4 -> 2.34.2
- urllib3 decompression bomb + cross-origin header leak: 2.6.3 -> 2.7.0
- glob CLI command injection, js-yaml merge-key DoS, @babel/core file
  read, and related transitive advisories resolved via npm audit fix

elliptic (GHSA-848j-6mx2-7j84) has no patched release and is a
build-time-only bundler dependency (browserify), not shipped in the
published wheel; left for alert dismissal.

Author: Pierre-Sassoulas

docs/requirements.txt

@@ -28,9 +28,9 @@ markupsafe==2.1.2
     # via jinja2
 packaging==23.1
     # via sphinx
-pygments==2.19.1
+pygments==2.20.0
     # via sphinx
-requests==2.32.4
+requests==2.34.2
     # via sphinx
 snowballstemmer==2.2.0
     # via sphinx
@@ -57,7 +57,7 @@ sphinxcontrib-serializinghtml==2.0.0
     # via sphinx
 tomli==2.4.0
     # via sphinx
-urllib3==2.6.3
+urllib3==2.7.0
     # via requests
 zipp==3.23.0
     # via importlib-metadata