Refresh the lock and move osv-scanner to v2.7.0 (#164)

## Summary

Routine dependency refresh.

- `uv lock --upgrade` moves seven transitive packages: aiohttp 3.14.5,
bitarray 3.12.1, google-auth 2.62.0, pycryptodome 3.24.1, pydantic
2.14.1, pydantic-core 2.50.1 and sentry-sdk 2.72.0. No declared range
changes.
- The dependency scan's pinned osv-scanner binary moves from v2.6.0 to
v2.7.0 in `.github/workflows/security.yml`. Dependabot does not track a
binary downloaded by URL, and the release asset name is unchanged.

The `web3<8` constraint stays: pympp 0.11.0 still requires `eth-abi<6`.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. The lockfile does not ship in the wheel, so the published package
is unchanged and no release is owed.

## Test plan

Run locally after `uv sync --all-extras --all-groups`:
- `ruff check`, `ruff format --check` and `ty check` all pass, and
`vulture . --min-confidence 80 --exclude .venv` passes;
- `pytest`: 1673 passed, 4 skipped, coverage 97.44% against the 95%
floor.

The only prerelease in the lock is OpenTelemetry's semantic-conventions
(`0.66b1`), which is beta-tagged by design.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
(nothing public changed)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/security.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.7.0/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies