DEPS: update numexpr to use not buggy numexpr 2.8.x anymore (update to 2.9.0) - fix critical CVE-2023-39631⁠

[nigzak]

update numexpr to 2.9.0 to fix CVE-2023-39631⁠ findings

HINT: come from other project (apache-superset) where panda is injecting this faulty numexpr inside the project as sub-dependency

• closes #xxxx (Replace xxxx with the GitHub issue number)
• Tests added and passed if fixing a bug or adding a new feature
• All code checks passed.
• Added type annotations to new arguments/methods/functions.
• Added an entry in the latest doc/source/whatsnew/vX.X.X.rst file if fixing a bug or adding a new feature.

[mroeschke]

Thanks for the PR, but pandas tries to support optional dependencies that are at most 1 year old. Additionally, pandas just species a lower pin, so a user is able to specify numexpr>=2.9.0 if they want to avoid this CVE. pandas will bump to 2.9.0 eventually, but I think it's too early to do so at this moment so closing