urllib3 upper bound <=2.6.3 in requirements blocks security fix

### Solution to issue cannot be found in the documentation.

- [x] I checked the documentation.

### Issue

awscli==2.36.0 pins urllib3<=2.6.3, which is vulnerable to CVE-2026-21441 (fixed in 2.7.0). Could the pin be bumped to <3 or <=2.7.0?

### Installed packages

```shell
awscli 2.36.0 py312h20c3967_0 conda https://conda.anaconda.org/conda-forge/
urllib3 2.6.3 pyhd8ed1ab_0 conda https://conda.anaconda.org/conda-forge/
python 3.12.13 hd63d673_0 conda https://conda.anaconda.org/conda-forge/
```

### Environment info

```shell
Pixi version: 0.61.0
Platform: linux-64
Channels: conda-forge
Python: 3.12.13 (hd63d673_0, conda-forge)
awscli: 2.36.0 (py312h20c3967_0, conda-forge)
urllib3: 2.6.3 (pyhd8ed1ab_0, conda-forge)
```

Start by locating the awscli 2.36.0 dependency pin in the feedstock's packaging configuration and inspect how dependency updates are validated. Update the urllib3 upper bound as requested, then verify that the package metadata and build or dependency checks accept a non-vulnerable urllib3 release.

Written by the indexing model from the issue text.