ROB-1574 Bump idna to 3.15 and drop bundled pip wheel to fix CVEs (#555)

## Summary
- **idna** 3.7 -> 3.15 in `pyproject.toml`, `poetry.lock` and
`requirements.txt`: CVE-2026-45409 (Medium). Closes dependabot alerts
#82, #83, #84.
- **Dockerfile**: remove ensurepip's bundled
`pip-25.0.1-py3-none-any.whl` from `python:3.12-slim`. The installed pip
is already upgraded to 26.x, but the leftover wheel is what Artifact
Registry flags on `devel/krr` for CVE-2025-8869, CVE-2026-3219,
CVE-2026-6357, CVE-2026-8643 (Medium).

## Verification
- `poetry lock --no-update` (Poetry 1.8.5): only idna changes in the
lock
- `pytest`: 55 passed
- Built the image (`linux/arm64`): idna 3.15, pip 26.2.1,
`ensurepip/_bundled/` empty, `import robusta_krr` and `krr.py --help`
work
- `grype` on the new image: no matches for idna, pip or any of the CVEs
above (the current `devel/krr:fix_cves_2` image shows
GHSA-65pc-fj4g-8rjx on idna 3.7)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: avi@robusta.dev <avi@robusta.dev>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Avi-Robusta

Dockerfile

@@ -22,6 +22,8 @@ COPY ./requirements.txt requirements.txt
 RUN pip install --no-cache-dir --upgrade pip
 # Install the project dependencies
 RUN python -m ensurepip --upgrade
+# Bundled pip 25.0.1 wheel carries CVE-2025-8869, CVE-2026-3219/6357/8643
+RUN rm -f /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl
 RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy the rest of the application code

poetry.lock

@@ -37,7 +37,7 @@ requests = ">=2.33.0"
 pyyaml = "6.0.1"
 # pytest-asyncio >=1.3 (needed for pytest 9 / CVE-2025-71176) requires typing-extensions >=4.12
 typing-extensions = ">=4.12.0,<5"
-idna = "3.7"
+idna = "3.15"
 urllib3 = "^2.7.0"
 setuptools = "^83.0.0"
 # transitive deps pinned for CVE fixes

pyproject.toml

@@ -15,7 +15,7 @@ fonttools==4.60.2 ; python_version >= "3.10" and python_full_version < "3.13"
 google-auth==2.28.2 ; python_version >= "3.10" and python_full_version < "3.13"
 grapheme==0.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
 httmock==1.4.0 ; python_version >= "3.10" and python_full_version < "3.13"
-idna==3.7 ; python_version >= "3.10" and python_full_version < "3.13"
+idna==3.15 ; python_version >= "3.10" and python_full_version < "3.13"
 jmespath==1.0.1 ; python_version >= "3.10" and python_full_version < "3.13"
 kiwisolver==1.4.5 ; python_version >= "3.10" and python_full_version < "3.13"
 kubernetes==26.1.0 ; python_version >= "3.10" and python_full_version < "3.13"