fix: require aiohttp>=3.13.5 to resolve CVE-2026-22815

Durable replacement for the lockfile-only bump on production (03d6bc4):
a version floor in pyproject.toml survives stlc regeneration, whereas
raw uv.lock changes conflict on every rebuild.

Author: ianhodge

pyproject.toml

@@ -41,7 +41,7 @@ Homepage = "https://github.com/warpdotdev/oz-sdk-python"
 Repository = "https://github.com/warpdotdev/oz-sdk-python"
 
 [project.optional-dependencies]
-aiohttp = ["aiohttp", "httpx_aiohttp>=0.1.9"]
+aiohttp = ["aiohttp>=3.13.5", "httpx_aiohttp>=0.1.9"]
 
 [tool.uv]
 managed = true