build(deps): bump aiohttp, cryptography, and asyncssh for security advisories

[HackedRico]

Description

Bumps three dependencies flagged by pip-audit in the safety tox env:

• aiohttp 3.14.1 -> 3.14.3 (PYSEC-2026-3545/3546/3547)
• cryptography 48.0.1 -> 50.0.1 (PYSEC-2026-3552/3553/3554)
• asyncssh 2.20.0 -> 2.23.1 (CVE-2026-54591)

Supersedes #3405 (aiohttp) and #3406 (cryptography). The asyncssh
advisory has no Dependabot PR yet and safety fails on master without it,
so all three are bumped together; neither open PR passes CI on its own.

All three require Python >= 3.10, so the full test matrix is unaffected.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Full suite run before and after the bump, on Python 3.13 and 3.11:

• pytest --asyncio-mode=auto tests - 562 passed on both, identical to the
  pre-bump baseline, with no new warnings
• pip-audit -r requirements.txt - no known vulnerabilities (was 4)
• pip-audit -r requirements-dev.txt - no known vulnerabilities
• bandit -r app -ll --skip=B303 - pass, 16 low / 0 medium / 0 high

The asyncssh bump is exercised end-to-end by
tests/contacts/test_ssh_tunneling.py, which starts the real tunnel server,
authenticates a client, and forwards a local port.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation (n/a)
• I have added tests that prove my fix is effective (existing coverage
  exercises all three packages; no new tests needed)