fix: require patched optional networking dependencies (#3651)

## Summary

- Require aiohttp `>=3.14.3` in the aiohttp extra.
- Require urllib3 `>=2.7.0,<3` in the Bedrock extra, so the published
package metadata excludes affected versions as well as the development
locks.
- Refresh the three lockfiles and add metadata regression checks. No SDK
API, default dependency graph, or Python-version change.

## Public advisories covered

- aiohttp:
[GHSA-cq5v-8q36-5273](https://github.com/advisories/GHSA-cq5v-8q36-5273),
[GHSA-mfx4-hv73-q22v](https://github.com/advisories/GHSA-mfx4-hv73-q22v),
[GHSA-mq44-7p77-q5h7](https://github.com/advisories/GHSA-mq44-7p77-q5h7)
- urllib3:
[GHSA-qccp-gfcp-xxvc](https://github.com/advisories/GHSA-qccp-gfcp-xxvc),
[GHSA-2xpw-w6gg-jr37](https://github.com/advisories/GHSA-2xpw-w6gg-jr37),
[GHSA-38jv-5279-wg99](https://github.com/advisories/GHSA-38jv-5279-wg99),
[GHSA-gm62-xv2j-4w53](https://github.com/advisories/GHSA-gm62-xv2j-4w53),
[GHSA-pq67-6m6q-mj2v](https://github.com/advisories/GHSA-pq67-6m6q-mj2v)

These are upstream package advisories; this change does not claim every
affected upstream code path is exercised by the SDK.

## Validation

- 273 focused dependency, HTTP client, and synchronous/asynchronous
Bedrock tests passed with the exact patched versions and locked Botocore
1.42.97.
- The same 273 tests and the Bedrock wheel smoke test passed with the
minimum supported Botocore 1.40.0.
- Python 3.10 minimum-version resolution, Ruff/Pyright/mypy, Python
policy check, wheel/sdist build, and wheel metadata checks passed.
- Only aiohttp and urllib3 versions changed in the Rye locks; the
separate dependency-cleanup change merges cleanly.

Co-authored-by: apcha-oai <228803254+apcha-oai@users.noreply.github.com>