Resolve Dependabot security lockfile alerts (#412)

## Summary

Updates vulnerable locked dependency versions reported by Dependabot
across the repo's `uv.lock` files:

- `soupsieve` -> `2.8.4` in root `uv.lock` for GHSA-2wc2-fm75-p42x /
GHSA-836r-79rf-4m37
- `langsmith` -> `0.10.5` in root and package lockfiles for
GHSA-f4xh-w4cj-qxq8 / GHSA-3644-q5cj-c5c7
- `langchain` -> `1.3.11` in root `uv.lock` for GHSA-gr75-jv2w-4656
- `langchain-classic` -> `1.0.8` in
`libs/langgraph-checkpoint-mongodb/uv.lock` for GHSA-3644-q5cj-c5c7
- `Pygments` -> `2.20.0` in root, `libs/langgraph-checkpoint-mongodb`,
and `libs/langchain-mongodb` lockfiles for GHSA-5239-wwwm-4pmq
- `pip` -> `26.1.2` in `libs/langchain-mongodb/uv.lock` for
GHSA-wf93-45jw-7689

## Validation

- `uv lock --project /tmp/langchain-mongodb --check`
- `uv lock --project /tmp/langchain-mongodb/libs/langgraph-store-mongodb
--check`
- `uv lock --project
/tmp/langchain-mongodb/libs/langgraph-checkpoint-mongodb --check`
- `uv lock --project /tmp/langchain-mongodb/libs/langchain-mongodb
--check`

## Notes

This supersedes the narrower open Dependabot/security PRs for the same
alert set, including the existing pip PR and stale Pygments PR.

Co-authored-by: Langster Security Agent <john@langchain.dev>