deps: patch three high-severity advisories, and declare the e2e test dep

requirements.txt — the four packages Dependabot flagged, plus one it could not:

  cryptography  46.0.7 -> 50.0.0   (covers all four open alerts)
  pyasn1        0.6.3  -> 0.6.4
  httplib2      0.22.0 -> 0.32.0
  pyparsing     3.0.9  -> 3.2.5    (NOT an alert: httplib2 0.32 needs >=3.1)

That last line is probably why the PRs stopped. Dependabot security updates bump
only the vulnerable package; httplib2 0.32 also requires moving pyparsing, so no
single-package PR resolves and it gives up silently. The last Dependabot PR here
was #206 on 2026-02-11, while the alerts kept arriving — 8 are open now.

Resolution verified in a python:3.12-slim container (the app.yaml runtime), not
locally: a 3.14 venv fails on `grpcio>=1.75.1; python_version >= "3.14"`, which
does not apply to the deployed runtime.

requirements-test.txt — add pytest-playwright. tests/test_e2e.py imports
playwright and uses the `page`/`base_url` fixtures, which come from the PLUGIN,
not the bare library; without it the module fails to import and 18 tests never
collect.

Suite before and after the bump is identical: 19 passed, 2 failed. Both failures
(test_plotusers append/create) are pre-existing — verified by running the same
tests against the original pins.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G7y9rTA1r8r8EhEnPSQenR

Author: sspickle

requirements-test.txt

@@ -1,2 +1,7 @@
 pytest
 pytest-mock
+# tests/test_e2e.py drives a DEPLOYED App Engine version:
+#   pytest tests/test_e2e.py --base-url https://VERSION-dot-glowscript.appspot.com
+# pytest-playwright supplies the `page` and `base_url` fixtures and pulls
+# playwright itself. Browsers still need `playwright install chromium`.
+pytest-playwright

requirements.txt

@@ -6,7 +6,7 @@ certifi==2024.7.4
 cffi==2.0.0
 charset-normalizer==3.1.0
 click==8.1.3
-cryptography==46.0.7
+cryptography==50.0.0
 Flask==3.1.3
 google-api-core==2.29.0
 google-api-python-client==2.189.0
@@ -20,18 +20,18 @@ googleapis-common-protos==1.70.0
 grpc-google-iam-v1==0.14.2
 grpcio==1.73.1
 grpcio-status==1.63.0rc1
-httplib2==0.22.0
+httplib2==0.32.0
 idna==3.15
 itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==2.1.2
 proto-plus==1.27.1
 protobuf==6.33.5
-pyasn1==0.6.3
+pyasn1==0.6.4
 pyasn1-modules==0.4.2
 pycparser==2.21
 pymemcache==4.0.0
-pyparsing==3.0.9
+pyparsing==3.2.5
 python-dotenv==1.2.2
 pytz==2023.3
 redis==4.5.5