deps: bump pyjwt to 2.15.1 and urllib3 to 2.8.0 (security)

Clears all 16 open Dependabot alerts on main. Both are transitive through
the azure extra (pyjwt via msal, urllib3 via requests); lock-only change.

- pyjwt 2.13.0 -> 2.15.1: 13 advisories, incl. the critical asymmetric-PEM
  HS/asymmetric confusion bypass, public JWK/DER keys accepted as HMAC
  secrets, BOM bypass, empty HMAC keys, PyJWKClient redirect-following, and
  RecursionError/ReDoS DoS. 2.15.x is past every affected range.
- urllib3 2.7.0 -> 2.8.0: unbounded chunk-size line buffering, HTTPS proxy
  TLS config ignored, chunked-deflate infinite loop.

Full suite: 2733 passed, 104 skipped.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: rustyconover