Fix vulnerable plugin dependency resolutions

[nabinchha]

What changed

• require DataDesigner 0.8.0 or newer for the GitHub and retrieval SDG plugins
• add published security floors for the GitHub plugin's vulnerable transitive dependencies
• raise retrieval SDG to NLTK 3.10.2 and PyArrow 24
• update workspace constraints and regenerate uv.lock

The resolved dependency set moves the scanned packages to:

• cryptography 49.0.0
• idna 3.18
• mcp 1.29.0
• nltk 3.10.2
• pillow 12.3.0
• pyarrow 24.0.0
• pyjwt 2.13.0
• python-multipart 0.0.32
• starlette 1.6.0

Why

The package manifests allowed older transitive versions from DataDesigner, and retrieval SDG explicitly capped NLTK below the scanner's recommended short-term version. This let isolated plugin installs resolve every vulnerable version listed in the supplied scan.

The scan lists cryptography 50 and PyArrow 25 as long-term upgrades. Current compatible DataDesigner releases cap those packages below those major versions, so this change uses the newest upstream-supported security floors (cryptography>=48.0.1,<50 and pyarrow>=24,<25) and resolves to cryptography 49 and PyArrow 24.

Impact

Fresh isolated installs of both affected plugins now exclude the versions found in the scan while remaining compatible with the current stable DataDesigner release.

Validation

• make all
• uv lock --check
• isolated plugin installs resolve the versions listed above
• 309 tests pass across devtools and all plugins
• all four plugin entry points validate