Remove upper bounds on cryptography dependency

Currently pyproject.toml has an upper bound on cryptography: https://github.com/aws/amazon-s3-encryption-client-python/blob/b067ea4b987181d907b675dac0cc99f69697dce4/pyproject.toml#L13

At the moment this is resulting in an older version being installed that has open CVEs assigned against it, as the package mostly uses major versions for new releases:

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ cryptography │ CVE-2026-69247 │ HIGH     │ fixed  │ 48.0.1            │ 50.0.0        │ python-cryptography: python-cryptography: PKCS#7         │
│              │                │          │        │                   │               │ EnvelopedData decryption exposes a Bleichenbacher oracle │
│              │                │          │        │                   │               │ through distinguishable errors...                        │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69247               │
│              ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────┤
│              │ CVE-2026-69249 │          │        │                   │ 49.0.0        │ python-cryptography: python-cryptography: Duplicate      │
│              │                │          │        │                   │               │ self-signed intermediates can cause exponential          │
│              │                │          │        │                   │               │ path-building                                            │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69249               │
│              ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────┤
│              │ CVE-2026-69248 │ MEDIUM   │        │                   │               │ python-cryptography: python-cryptography:                │
│              │                │          │        │                   │               │ python-cryptography verifier accepts wildcard DNS names  │
│              │                │          │        │                   │               │ allowing escape from permittedSubtrees...                │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69248               │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

These days we can override this with uv, but unless there's a technical need due to incompatibility - it would be appreciated if the upper bound is removed.

Comece pela declaração da dependência cryptography em pyproject.toml na linha 13 e verifique como o uv a resolve. Remova o limite superior e, em seguida, verifique se a resolução de dependências pode selecionar uma versão igual ou superior às versões corrigidas indicadas, em vez da versão vulnerável 48.0.1.