sagemaker-train should depend on mlflow-skinny, following sagemaker-mlflow 0.5.0

## Describe the feature you'd like

`sagemaker-train` (and `sagemaker-serve`) declare an unconditional dependency on the full `mlflow` distribution:

```
sagemaker-train 1.18.0: mlflow<4.0.0,>=3.0.0
```

The training integration uses MLflow purely as a tracking client (logging runs and metrics to a configured tracking server), which `mlflow-skinny` implements completely. The full distribution additionally drags in the tracking server stack and its dependency constraints.

`sagemaker-mlflow` already made exactly this change in 0.5.0: `mlflow-skinny>=2.8` as the base requirement, with full mlflow relegated to an optional `full` extra. Applying the same pattern to `sagemaker-train` and `sagemaker-serve` would make the SDK family consistent.

## Why it matters

Full mlflow currently caps `cryptography<50`. Snyk advisories SNYK-PYTHON-CRYPTOGRAPHY-18516620/21/22 (two high severity) are fixed only in cryptography 50.0.0, so any project consuming sagemaker-train transitively cannot reach the fixed version and must either waive the findings or remove sagemaker-train. Since the mlflow usage is client-only, the cap buys nothing for these packages.

## Suggested change

Mirror sagemaker-mlflow 0.5.0: depend on `mlflow-skinny`, offer full mlflow behind an extra for anyone who genuinely needs the server components.

Prüfe die Abhängigkeitsmetadaten für sagemaker-train und sagemaker-serve und vergleiche sie anschließend mit dem im Issue beschriebenen Muster von sagemaker-mlflow 0.5.0. Verifiziere, dass mlflow-skinny die Basisanforderung ist, das vollständige mlflow über ein optionales Extra verfügbar ist und die Auflösung der Abhängigkeiten nicht mehr die gemeldete Obergrenze für cryptography erzwingt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.