Update py-hydroweb (pins requests<2.33)

One alert that couldn't be fully resolved — requests>=2.33.0:
py-hydroweb (a direct dependency) pins requests<2.33, creating an irreconcilable conflict. The constraint is left as a comment in pyproject.toml. This will resolve automatically once the upstream py-hydroweb package relaxes its requests upper bound. The requests alert also transitively covers the idna exposure via the same packages, which is now mitigated by the idna>=3.15 constraint.