sagemaker-train should depend on mlflow-skinny, following sagemaker-mlflow 0.5.0

## Describe the feature you'd like

`sagemaker-train` (and `sagemaker-serve`) declare an unconditional dependency on the full `mlflow` distribution:

```
sagemaker-train 1.18.0: mlflow<4.0.0,>=3.0.0
```

The training integration uses MLflow purely as a tracking client (logging runs and metrics to a configured tracking server), which `mlflow-skinny` implements completely. The full distribution additionally drags in the tracking server stack and its dependency constraints.

`sagemaker-mlflow` already made exactly this change in 0.5.0: `mlflow-skinny>=2.8` as the base requirement, with full mlflow relegated to an optional `full` extra. Applying the same pattern to `sagemaker-train` and `sagemaker-serve` would make the SDK family consistent.

## Why it matters

Full mlflow currently caps `cryptography<50`. Snyk advisories SNYK-PYTHON-CRYPTOGRAPHY-18516620/21/22 (two high severity) are fixed only in cryptography 50.0.0, so any project consuming sagemaker-train transitively cannot reach the fixed version and must either waive the findings or remove sagemaker-train. Since the mlflow usage is client-only, the cap buys nothing for these packages.

## Suggested change

Mirror sagemaker-mlflow 0.5.0: depend on `mlflow-skinny`, offer full mlflow behind an extra for anyone who genuinely needs the server components.

Kiểm tra siêu dữ liệu dependency của sagemaker-train và sagemaker-serve, sau đó so sánh với pattern sagemaker-mlflow 0.5.0 được mô tả trong issue. Xác minh rằng mlflow-skinny là requirement cơ sở, mlflow đầy đủ có sẵn thông qua một extra tùy chọn và việc resolve dependency không còn áp đặt giới hạn trên cryptography đã được báo cáo.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.