bumps idna to 3.15 and setuptools to 83.0.0

[semx]

Closes the two open Dependabot findings that still apply to development:

package	from	to	advisory
idna	3.11	3.15	CVE-2026-45409 / GHSA-65pc-fj4g-8rjx, crafted input to idna.encode() bypasses the CVE-2024-3651 length check and burns CPU (medium, CVSS 5.3)
setuptools	82.0.1	83.0.0	CVE-2026-59890 / GHSA-h35f-9h28-mq5c, MANIFEST.in exclusion bypass via NFC/NFD collision (medium, CVSS 6.1)

Changes: requirements.txt, the setuptools pin in pyproject.toml, and uv.lock regenerated with uv lock --upgrade-package for just these two packages (the lock diff touches nothing else). setuptools 83 requires Python 3.10+, within the project's 3.13 floor.

The urllib3 and requests alerts in the Dependabot tab are reported against main (v1.8.1); development already carries 2.7.0 and 2.34.2, so they close with the next release.

Verification

• Clean Python 3.14 environment built the way the Dockerfile does it (pip install -r requirements.txt, then pip install --upgrade vcf-sdk): pip-audit goes from 4 findings in 2 packages (idna, setuptools) to none.
• pip freeze before vs after differs in exactly these two packages.
• The vSphere automation SDK imports as before (com.vmware.vapi.std_client, vmware.vapi.vsphere.client), vsphere_automation_sdk_available is True, and create_vsphere_client() gets as far as the network call. Regarding VMware SDK import fails on Python 3.12+ with setuptools >= 82 (pkg_resources removed) #497: vmware-vapi-runtime 9.1.0.0 resolves versions through importlib.metadata and only falls back to pkg_resources inside an except, so setuptools without pkg_resources is fine here (it already is on development with 82.0.1).
• The unit tests from Fix skip_fhrp_group_ips unbinding all interface IPs and py<3.12 import (continues #476) #538 pass against the bumped environment.
• Real docker build --platform linux/amd64 of the Dockerfile with these pins succeeds; inside the image: setuptools 83.0.0, idna 3.15, urllib3 2.7.0, requests 2.34.2, the SDK import works, netbox-sync.py --help runs, and pip-audit over the image's installed packages reports no known vulnerabilities.