v0.4.0.2: lock patched django, gunicorn, cryptography, hiredis, msgpack, Markdown, ujson

[tanhtm]

Projects building on the v0.4.0.1 Docker base had to pin 7 packages above the base because the base lock carried unpatched versions. The base images install exactly uv.lock, so this moves the lock to the patched releases:

Package	0.4.0.1	0.4.0.2
django	6.0.8	6.0.9
gunicorn	26.0.0	26.2.0
cryptography	50.0.0	50.0.2
hiredis	3.4.0	3.4.2
msgpack	1.2.1	1.2.3
Markdown	3.10.2	3.11.1
ujson	5.13.0	6.0.0

• Only these 7 packages change in uv.lock, via uv lock --upgrade-package.
• django>=6.0.9 is now the minimum.
• The version is bumped to 0.4.0.2, with CHANGELOG and README entries.
• There are no code, template or migration changes.

ujson 6.0.0 and msgpack are only used through autobahn/daphne and channels-redis.

Validation

• The 48 package tests pass, and check is clean.
• autobahn, daphne, channels_redis, markdown, msgpack and ujson import and round-trip correctly.
• pip-audit on the exported runtime lock reports no known vulnerabilities.