Resolve remaining dev-tooling Dependabot alerts to clear the Security tab #1201

Context

After the shipping-path fixes landed (#1200: urllib3 2.8.0, idna 3.20), the CLI's Security tab still shows 37 open Dependabot alerts, all in dev/build tooling that is not part of the shipped b2 wheel. They are pulled in only by the nox/doc/lint/bundle dependency-groups, never by the runtime dependencies (argcomplete, arrow, b2sdk, certifi, docutils, rst2ansi, tabulate, tqdm, platformdirs). None reach a user who runs pip install b2.

This issue drives the Security tab to 0 open via two mechanisms — bump what has a compatible fix, dismiss (with a documented, verified reason) what is pinned by a real constraint.

Current alerts by package

The constraints that block a clean bump

• setuptools is pinned >=60,<80 in two places ([dependency-groups].lint for liccheck, [project.optional-dependencies]/bundle for the Linux bundle build), but both advisories require >=83. Raising the cap must be verified against liccheck and the non-isolated Linux bundle build; if either breaks, the setuptools alerts are dev-only with no compatible fix and get dismissed.
• starlette 1.x is a major bump; Dependabot's PR to exactly 1.3.1 failed lint, so it needs sphinx-autobuild moved to a compatible version, or dismissal.

Acceptance criteria

• Every dev-tooling alert with a compatible fix is closed by bumping the relevant group (uv lock --upgrade-package ..., and/or bumping nox/sphinx-autobuild), with pyproject.toml runtime bounds unchanged and nox -vs lint unit green.
• go.mod/pyproject.toml runtime dependency bounds are not touched (dev groups only).
• Any alert that genuinely cannot be fixed under the CLI's own constraints is documented here with the reason, so it can be dismissed on the Security tab as "vulnerable code not in use (dev/build tooling, not in the shipped artifact)."
• The Security tab reads 0 open after the bumps merge and the documented-stuck ones are dismissed.

Scope / out of scope

In scope: the dev/build dependency-groups only.
Out of scope: runtime dependencies (already fixed in #1200), and any change to what the shipped b2 wheel installs.

Links

• Shipping-path fix already merged: Bump urllib3 to 2.8.0 and idna to 3.20 to close shipping advisories #1200
• Stale Dependabot PRs being superseded by the consolidated bump: Bump idna from 3.11 to 3.15 #1147 (idna, already fixed by Bump urllib3 to 2.8.0 and idna to 3.20 to close shipping advisories #1200), Bump starlette from 0.52.1 to 1.3.1 #1151 (starlette), Bump pip from 26.1 to 26.1.2 #1153 (pip), Bump setuptools from 79.0.1 to 83.0.0 #1154 (setuptools).