Loosen azure-core and requests pins to permit CVE-patched versions

[mividtim]

Summary

Loosen two transitive dependency pins in requirements.txt from compatible-release (~=) minor locks to SemVer-compatible major-range constraints, so downstream consumers can apply patched versions of requests CVEs (and any future minor-version security patches) without forking.

-azure-core~=1.38.0
-requests~=2.32.5
+azure-core>=1.38.0,<2
+requests>=2.32.5,<3

Why

The current ~= pins lock azure-core to 1.38.x and requests to 2.32.x. Any CVE patched in a subsequent minor (e.g. 1.39.x, 2.33.x) cannot be applied by downstream consumers without forking or pinning-over.

Currently blocked CVE

requests — GHSA-gc5v-m9x4-r6x2 — Insecure Temp File Reuse in extract_zipped_paths(). Severity: medium. First patched in requests 2.33.0, which the current ~=2.32.5 pin disallows.

Why also loosen azure-core

azure-core's own current vulnerabilities (e.g. GHSA-jm66-cg57-jjv5, HIGH, deserialization) are already patched in 1.38.0, so today's ~=1.38.0 pin technically covers them. The loosening here is forward-looking: the same minor-lock that's currently biting requests will eventually bite azure-core too. Both libraries publish under SemVer; relaxing to <MAJOR+1 keeps the upstream-declared compatibility contract while letting downstream consumers stay current on patches.

Downstream impact

Our service (fabrica-land/avm-python-service) consumes openavmkit and is transitively bound by these pins. Until this PR merges and a release ships, we have to either fork (what we're doing for now), use pip install --use-deprecated=legacy-resolver (which silently downgrades our pins to satisfy upstream — defeating the purpose), or knowingly ship the requests MODERATE.

Verification

The change is constraint-only — no runtime code touched. We have not run openavmkit's test suite against the newer minors ourselves, so this PR does not assert empirical behavioral equivalence; it relies on the SemVer guarantees published by azure-core and requests.

CLA

Happy to sign when the bot comments.

[github-actions]

Thank you for your contribution.
Please sign our CLA at the following link:
Click here to sign the CLA.
A maintainer will verify your signature and confirm it here by commenting with the following sentence:

---

I affirm that this contributor has signed the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}