chore: Update PyO3 to fix vulnerability

[swenger]

See GHSA-36hh-v3qg-5jq4.

[skuenzli]

@swenger - thank you for the PR!

The GHSA-36hh-v3qg-5jq4 and GHSA-chgr-c6px-7xpp Py03 advisories aren't reachable in cedar-py [1], so I deferred them to avoid churn and perf+correctness risk of updating Py03.

That said, I plan to merge this PR because I'm in the process of building the next release with a cedar engine bump and features. So will be doing another round of benchmarking.

[1] I built the Reachable Risk tool to help engineers triage dependency alerts so they can focus on the ones that actually need to be fixed

[skuenzli]

Thanks @swenger! We validated this PR locally on Apple Silicon (macOS, CPython 3.11) beyond the green CI:

Check	Result
Release build (maturin develop --release, pyo3 0.29.2)	clean — no source changes needed
Unit tests	218 passed
Official Cedar integration suites	78 passed
Cedar corpus tarball	60,800 passed (expected count for cedar 4.12)
Benchmarks (N=5 runs, median Δ vs cedar-4.12.0 baseline, 5% gate)	35/35 PASS — Δ range −1.2% to +2.6%, within ambient drift
Submodule pointers	identical to main
Cargo.lock churn	minimal and expected; also reduces the stale windows-sys 0.59 duplicate from 3 consumers to 1

Context on the two advisories this bump fixes (GHSA-36hh-v3qg-5jq4 and GHSA-chgr-c6px-7xpp): both were previously triaged and dismissed as unreachable from cedarpy's API (no nth/nth_back calls on list/tuple iterators; PyCFunction::new_closure never used), so this upgrade is defense-in-depth — and it completes the pyo3 0.27→0.29 migration we had deferred. Both alerts will auto-close on merge.

We pushed one commit to the branch adding the CHANGELOG.md entry under [Unreleased].

[swenger]

Thanks @skuenzli!