fix(deps): bump pip and paramiko to drop pip-audit ignores

OSV no longer flags pip 26.1.1 (GHSA-58qw-9mgm-455v) or paramiko
5.0.0 (GHSA-r374-rxx8-8654), so override both to those minimums
and remove the corresponding --ignore-vuln entries. paramiko is
pulled in transitively via composio-core.

.github/workflows/vulnerability-scan.yml

@@ -46,8 +46,6 @@ jobs:
       - name: Run pip-audit
         run: |
           uv run pip-audit --desc --aliases --skip-editable --format json --output pip-audit-report.json \
-            --ignore-vuln CVE-2026-3219 \
-            --ignore-vuln GHSA-r374-rxx8-8654 \
             --ignore-vuln PYSEC-2024-277 \
             --ignore-vuln PYSEC-2026-89 \
             --ignore-vuln PYSEC-2026-97 \
@@ -73,8 +71,6 @@ jobs:
             --ignore-vuln PYSEC-2025-217 \
             --ignore-vuln PYSEC-2025-218
         # Ignored CVEs:
-        #   CVE-2026-3219       - pip 26.0.1 (GHSA-58qw-9mgm-455v): no fix available, archive handling issue
-        #   GHSA-r374-rxx8-8654 - paramiko 4.0.0 (SHA-1 in rsakey.py): no fix available; transitive via composio-core
         #   PYSEC-2024-277      - joblib 1.5.3: disputed; NumpyArrayWrapper only used with trusted caches
         #   PYSEC-2026-89       - markdown 3.10.2: DoS via malformed HTML; fix 3.8.1 — already past, advisory range is stale
         #   PYSEC-2026-97       - nltk 3.9.4: arbitrary file read in filestring(); no fix available