Bump dev-tooling dependencies to clear Dependabot advisories - #1202

Context

After the shipping-path fixes (#1200), 37 dev/build-tooling Dependabot alerts remained. None ship in the b2 wheel (they come from the nox/doc/lint/bundle groups). This closes every one that has a compatible fix and documents the handful that are blocked by the CLI's own Python-version / tooling constraints (for dismissal).

Changes

uv.lock only (plus a changelog fragment); no pyproject.toml runtime-bound changes:

• anyio 4.12.1 -> 4.14.2
• virtualenv 21.1.0 -> 21.14.9
• filelock 3.24.3 -> 4.1.0 (Python 3.10) / 4.2.9 (Python >= 3.11)
• starlette 0.52.1 -> 1.3.1 (sphinx-autobuild accepts it)
• supporting transitive bumps: distlib, packaging, python-discovery, typing-extensions

Closes (27 alerts)

• virtualenv (19) — 21.14.9 meets every fixed floor
• starlette (5) — 1.3.1
• anyio (2, incl. the critical) — 4.14.2
• filelock (1) — Python 3.10's 4.1.0 exceeds its 4.0.9 fix

Not fixable under current constraints (10 alerts — to be dismissed as dev-only, not in the shipped artifact)

• filelock (8): the fix is 4.2.1, which requires Python >= 3.11, but the CLI supports and tests Python 3.10, where the newest compatible version is 4.1.0. Dev-only (nox/virtualenv), not in the b2 wheel.
• setuptools (2): bumping to the fixed >= 83 (resolves 84.x) breaks liccheck 0.9.2 (ModuleNotFoundError: No module named 'pkg_resources'). The cap experiment was reverted. Lint/Linux-build-only, not a runtime dependency.

Verification

nox -vs lint unit passes with B2 credential variables unset: lint, unit on pypy3.10 + 3.10/3.11/3.12/3.13/3.14 (CLI v3/v4/v5: 523/527/526 passed), coverage 83%. git diff master -- pyproject.toml is empty (runtime bounds untouched). The Linux bundle build was not run locally (macOS host); its declaration is unchanged, so no bundle impact — CI confirms.

Closes #1201