deps: require httpx2 >= 2.12.0 (three security advisories)

Raises the floor from 2.9.1 and upgrades the lock from 2.10.0 to
2.13.1 (httpcore2 follows; 2.13 adds backports-zstd). Fixes, for both
this repo and anyone installing vgi-python from PyPI:

- GHSA-8xx6-hgc6-gc2m (high): streaming decompression did not bound
  peak memory, so a hostile HTTP worker or storage endpoint could
  exhaust client memory with a small compressed response
- GHSA-h4x7-gw46-3wm6 (medium): multipart part header injection
- GHSA-pf96-p4fj-6566 (medium): conflicting Content-Length and
  Transfer-Encoding headers could be auto-generated

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: rustyconover

pyproject.toml

@@ -41,7 +41,7 @@ dependencies = [
     "typer>=0.9",
     "platformdirs",
     "vgi-rpc>=0.47.0",
-    "httpx2>=2.9.1",
+    "httpx2>=2.12.0",
 ]
 
 [project.optional-dependencies]