Bump webob from 1.8.6 to 1.8.9 in /pyramid/pyramidsite

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps webob from 1.8.6 to 1.8.9.

Changelog

Sourced from webob's changelog.

1.8.9 (2024-11-23)

Bugfix

- Add `legacy-cgi` to required packages to be installed for Python 3.13
  compatibility. See https://github.com/Pylons/webob/pull/469
1.8.8 (2024-08-13)
Security Fix

• The use of WebOb's Response object to redirect a request to a new location can lead to an open redirect if the Location header is not a full URI.

  See GHSA-mg3v-6m49-jhp3 and CVE-2024-42353

  Thanks to Sara Gao for the report

1.8.7 (2021-02-17)

Bugfix

- Decoding deflate-encoded responses now supports data which is packed in
  a zlib container as it is supposed to be. The old, non-standard behaviour
  is still supported.
See Pylons/webob#426

Commits

• 5216c0d Add info for 1.8.9 fix for Python 3.13
• ea84e00 Merge pull request #469 from luhn/1.8-legacy-cgi
• 8b2fc22 Add legacy-cgi dependency for Python 3.13+
• f2bdd83 Merge commit from fork
• 913fa2c Update CHANGES.txt
• f2e92f3 WebOb version revised to 1.8.8
• a06856a Build the latest version from tox
• 819f43c Add MANIFEST.in to build source tarball
• 411df96 s/isAlive/is_alive/
• 5ae9b5d Update for newer versions of tox/sphinx
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)