chore: pin aiohttp>=3.14.3 security floor for transitive CVE fix - #14

litellm pulls aiohttp in transitively; 3.13.x is affected by
CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. Add an
explicit security floor so dependency resolution cannot select an
affected version.
Verified: pip-audit reports no known vulnerabilities after the bump,
and the full test suite (270 passed, 1 skipped) is green under
aiohttp 3.14.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The previous floor (>=3.14.0) is no longer sufficient: aiohttp 3.14.0
is affected by CVE-2026-54273 through CVE-2026-54280, fixed in 3.14.1.
Raising the floor clears these from pip-audit while staying within
litellm's transitive dependency range.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The >=3.14.1 floor on this branch has been overtaken: aiohttp 3.14.0
through 3.14.2 are affected by CVE-2026-59881 (client decompresses
WebSocket frames with RSV1 set even when permessage-deflate was not
negotiated), CVE-2026-69243 (request smuggling via an edge case in the
WebSocket upgrade procedure) and CVE-2026-69244 (out-of-bounds heap read
in the C response parser while formatting an error for a malformed
response). All three are fixed in 3.14.3, so the floor is raised to match
and the comment updated to record them.
Verified locally: pip install -e ".[dev]" resolves aiohttp 3.14.3,
270 tests pass / 1 skipped, ruff check and ruff format --check are clean,
and pip-audit drops from 16 findings to 13 (all three aiohttp entries
clear).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>