Upgrade dependencies and bump minimum Python to 3.10

[frankw2]

Summary

• Bump minimum Python from 3.9 to 3.10 — Python 3.9 reached EOL on 2025-10-31
• Upgrade 7 dependencies to latest stable versions
• Pin setuptools >=78.1.1 in CI to mitigate CVE-2025-47273 (path traversal, CVSS 8.8)
• Pin yapf ==0.43.0 in CI for reproducible formatting checks
• Update README to reflect Python 3.10+ requirement
• pytest and requests are [SECURITY] related upgrades.

Dependency changes

Package	Old	New
certifi	2025.10.5	2026.2.25
charset-normalizer	3.4.3	3.4.7
idna	3.10	3.11
iniconfig	2.1.0	2.3.0
packaging	25.0	26.1
pytest	8.4.2	9.0.3
requests	2.32.5	2.33.1

No breaking changes

• requests 2.33.1 renames _get_connection to get_connection_with_tls_context on HTTPAdapter, but this codebase only uses top-level requests.get/post/put/patch/delete — no HTTPAdapter subclassing.
• pytest 9.0 drops Python 3.9 support and removes nose-style test discovery and yield_fixture. Our tests use standard pytest.raises, unittest.TestCase, and unittest.mock — none of the removed APIs.
• packaging 26.1 changes default values on packaging.metadata.Metadata attributes. This package is only a transitive dependency and is not imported directly anywhere in the codebase.
• certifi, charset-normalizer, idna, iniconfig are all patch/minor bumps with no API changes.

Test plan

• CI passes with Python 3.14 and upgraded dependencies
• pytest runs all existing tests successfully
• yapf formatting check passes