fix(deps): patch vulnerable dependencies flagged by Dependabot

[tanhtm]

Summary

Fixes the vulnerabilities Dependabot reports for uv.lock and package-lock.json on main2.0. The Python ones matter for the release: the Docker base images now install exactly uv.lock, so v0.4.0.0 would otherwise ship them.

Python (uv.lock)

Only the affected packages were upgraded:

Package	Used by	Advisory	Change
tablib	production (import/export)	stored XSS in HTML export	3.9.0 → 3.10.0
urllib3	production	3 advisories (streaming API, proxy TLS)	2.7.0 → 2.8.0
anyio	production	3 advisories	4.14.1 → 4.15.1
autobahn	production (WebSocket)	payload size checked after decompression	26.6.2 → 26.7.1
soupsieve	production (markdown preview)	2 regex advisories	2.8.4 → 2.10
virtualenv	dev only	4 advisories	21.5.1 → 21.14.5

soupsieve is kept on 2.x (2.10, the latest 2.x). uv would otherwise pick 3.0.3, and the fix is already in 2.9.

npm (package-lock.json, Tailwind build tooling only, not shipped)

• Removed @tailwindcss/typography. styles.css never loads it, and it was the source of the postcss-selector-parser advisory.
• Ran npm audit fix for braces, micromatch, nanoid, postcss, source-map-js and @parcel/watcher.

CHANGELOG, README and the v0.4.0.0 release notes are updated.

Validation

• pip-audit (all groups and extras) and npm audit report no known vulnerabilities.
• manage.py test whiteneuron: 42 tests pass. check is clean.
• Smoke checks on the upgraded libraries:
  • markdown preview (convert_md_to_html) renders admonitions and tables;
  • tablib exports xlsx.
• Rebuilt styles.css is unchanged.
• This PR's CI runs the tests, the CSS check and both Docker base image builds (uv.lock changed).