fix(deps): unblock cryptography >=48, OTel 1.44, protovalidate 0.15

[ArthurTonial]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Fixes three dependency issues introduced by the version pinning in 0.49.2 that are blocking consumers from installing or running the SDK:

cryptography HIGH vulnerability (GHSA-537c-gmf6-5ccf)
Widened cryptography from >=46.0.3,<47 to >=48.0.1,<51. All versions below 48 bundle a vulnerable OpenSSL and are flagged HIGH by SAP Security Validation.

protovalidate / protobuf runtime crash
The 0.49.2 pin of protobuf>=6.0.0,<7 alongside protovalidate<1 causes a hard crash at service startup:

AttributeError: 'google._upb._message.FieldDescriptor' object has no attribute 'label'
File ".../protovalidate/internal/rules.py", line 1060

protovalidate 0.x calls FieldDescriptor.label which was removed in protobuf 6.0. The metadata omission (protobuf>=5, no upper bound) means pip resolves the conflict silently and the crash only surfaces at runtime.
Fix: downgrade the protobuf constraint to >=5.29.5,<6 and regenerate all bundled _pb2.py files with the matching buf.build/protocolbuffers/python:v29.3 plugin. The <6 cap is safe — no dependency in the tree requires protobuf 6.

OTel 1.44.0 blocked
The ~=1.43.0 pin on opentelemetry-exporter-* resolved to >=1.43.0, ==1.43.*, excluding 1.44.0. Consumers already on 1.44.0 were forced to downgrade. Updated exporters to ~=1.44.0 and instrumentation packages to ~=0.65b0.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Install: uv sync
2. Confirm resolved versions:
   • cryptography ≥ 48.0.1
   • protobuf 5.29.x
   • opentelemetry-sdk 1.44.x
3. Verify no startup crash: uv run python -c "from sap_cloud_sdk.core.auditlog_ng import client"
4. Run unit tests: uv run pytest tests/ -m "not integration and not aicore"
   • Expected: 3087 passed

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Breaking Changes

None. All constraint changes either widen an existing range or restore a prior lower major version.

Additional Notes

buf.gen.yaml was updated from plugin v33.5 to v29.3 to match the new protobuf<6 runtime. All four generated _pb2.py / _pb2.pyi files under src/buf/ and src/sap_cloud_sdk/core/auditlog_ng/gen/ were regenerated accordingly. Future proto regeneration must use a protobuf 5.x plugin until protovalidate is migrated to 2.x.

[NicoleMGomes]