Loosen cryptography pin (<49.0.0) — blocks upgrade past known CVEs CVE-2026-69247/CVE-2026-69249 #2234

presidio-anonymizer pins cryptography>=48.0.1,<49.0.0, which excludes
all cryptography versions >= 49.0.0. Two disclosed vulnerabilities in
cryptography are fixed only at or after that boundary:

• CVE-2026-69249 (CVSS 8.7, CWE-400 resource exhaustion/DoS via
  exponential path-building on duplicate self-signed intermediates) —
  fixed in cryptography 49.0.0 (Add a signature validation budget during path construction pyca/cryptography#14960)
• CVE-2026-69247 (CVSS 8.2, CWE-208/209 Bleichenbacher oracle in PKCS#7
  EnvelopedData decryption) — fixed in cryptography 50.0.0
  (Don't leak how PKCS#7 encryptedKey decryption failed pyca/cryptography#15369)

Because the pin's upper bound is exclusive of 49.0.0, pip cannot resolve
presidio-anonymizer alongside a patched cryptography version at all —
consumers must choose between presidio-anonymizer and a fixed
cryptography, they can't have both.