v2.11.4

Raises the cryptography ceiling to >=50.0.0,<51.0.0 so consumers pick up the fixes for two vulnerabilities in the previously-pinned 48.x range:

• CVE-2026-69247 (GHSA-g6cj-pr64-35w5) — PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle. Fixed in cryptography 50.0.0.
• CVE-2026-69249 (GHSA-jwv3-5hgf-82ww) — Duplicate self-signed intermediates cause exponential path-building. Fixed in cryptography 49.0.0.

No API changes.

Ref: #399.