chore: close the cryptography advisories and stop the SSL tests skipping

[cayossarian]

Summary

Three changes that belong inside 3.0.0 rather than in a release after it — nothing has been tagged yet, so there is no published artifact to correct.

cryptography becomes an explicit dev dependency

tests/test_ssl_context.py (added in #148) mints an AKI-less CA and runs a real TLS handshake against it. It needs cryptography, which was never declared — it reached the environment only as a transitive of twine -> keyring -> secretstorage, and secretstorage carries sys_platform == 'linux'.

The consequence is the failure mode DEVELOPMENT.md already warns about: the module ran on ubuntu-latest and skipped silently on every macOS checkout, which reads in the summary line exactly like passing.

Measured rather than assumed — 12 skips before, 11 after, and that module's 8 tests now execute locally:

tests/test_ssl_context.py .......  8 passed

Floored at 50.0.0, superseding #154

Four advisories cover the range below 50.0.0 (one medium, three high), the highest of them first patched exactly there:

Alert	Vulnerable range	First patched
Wildcard DNS names escape verification	<= 48.0.0	49.0.0
Duplicate self-signed intermediates	<= 48.0.0	49.0.0
PKCS#7 Bleichenbacher oracle	>= 44.0.0, < 50.0.0	50.0.0
Vulnerable OpenSSL in wheels	< 48.0.1	48.0.1

This supersedes #154, whose lock-only diff was cut on 2026-08-04 against the 2.6.4 lock and no longer applies — main's lock has since been replaced wholesale, and that PR is CONFLICTING.

The floor is the load-bearing half of this, not the lock bump. uv.lock is not published and binds nobody who checks this repository out; a floor is a constraint the resolver enforces for everyone, and it encodes why 50.0.0 rather than leaving it as whatever the lock last resolved.

No user was exposed, and no extra release is needed

cryptography is not a runtime dependency. 3.0.0 requires httpx, paho-mqtt and pyyaml; the only package in the lock that pulls cryptography is a dev-group transitive, on Linux only. It appears in no wheel's metadata.

Dependabot reports all four alerts as scope: runtime because it cannot read uv's [dependency-groups] out of uv.lock. That label is wrong for this repository.

Changelog

The 3.0.0 entry had no Fixed section at all, so the release described none of the CA-endpoint 429 retry that landed in #148. Added, written against 2.6.4 per the changelog policy and credited to @brunocramos.

The VERIFY_X509_STRICT clear from that same PR is deliberately not listed: it changes nothing observable on any code path this library takes, and the policy excludes changes that are not outward-facing.

Verification

Full hook set and suite, on cryptography==50.0.0:

20/20 hooks passed (ruff, black, mypy, pylint, bandit, vulture, uv lock check, ...)
935 passed, 11 skipped
Total coverage: 95.38%