Remove upper bounds on cryptography dependency

Start with the cryptography dependency declaration in pyproject.toml at line 13 and check how uv resolves it. Remove the upper bound, then verify that dependency resolution can select a version at or above the stated fixed versions rather than the vulnerable 48.0.1 release.

Currently pyproject.toml has an upper bound on cryptography: https://github.com/aws/amazon-s3-encryption-client-python/blob/b067ea4b987181d907b675dac0cc99f69697dce4/pyproject.toml#L13

At the moment this is resulting in an older version being installed that has open CVEs assigned against it, as the package mostly uses major versions for new releases:

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ cryptography │ CVE-2026-69247 │ HIGH     │ fixed  │ 48.0.1            │ 50.0.0        │ python-cryptography: python-cryptography: PKCS#7         │
│              │                │          │        │                   │               │ EnvelopedData decryption exposes a Bleichenbacher oracle │
│              │                │          │        │                   │               │ through distinguishable errors...                        │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69247               │
│              ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────┤
│              │ CVE-2026-69249 │          │        │                   │ 49.0.0        │ python-cryptography: python-cryptography: Duplicate      │
│              │                │          │        │                   │               │ self-signed intermediates can cause exponential          │
│              │                │          │        │                   │               │ path-building                                            │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69249               │
│              ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────┤
│              │ CVE-2026-69248 │ MEDIUM   │        │                   │               │ python-cryptography: python-cryptography:                │
│              │                │          │        │                   │               │ python-cryptography verifier accepts wildcard DNS names  │
│              │                │          │        │                   │               │ allowing escape from permittedSubtrees...                │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-69248               │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

These days we can override this with uv, but unless there's a technical need due to incompatibility - it would be appreciated if the upper bound is removed.