fix(security): validate URLs before network requests in arxiv tool and devtools

Apply validate_url() before fetching the arXiv API and PyPI polling
endpoints. Replace urllib.request.urlopen with requests.get to satisfy
bandit S310 without noqa suppressions. Update arxiv tool tests to mock
requests.get and validate_url.

Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>

lib/devtools/pyproject.toml

@@ -16,6 +16,7 @@ dependencies = [
     "python-dotenv>=1.2.2,<2",
     "pygithub~=1.59.1",
     "rich>=13.9.4",
+    "crewai-tools",
 ]
 
 [project.scripts]