fix(deps): bump pygments lower bound to >=2.20.0 for CVE-2026-4539 [PYSDK-106]

Re-adds the `pygments>=2.20.0` lower bound to `[project].dependencies`
transitive overrides in pyproject.toml. The bound was deliberately
removed in PYSDK-104 (PR #592) to give the daily audit-vulnerabilities
routine a real gap to remediate; this PR closes that gap.

The locked version in uv.lock (pygments 2.20.0) already protects our
dev/CI env from CVE-2026-4539 (Pygments AdlLexer ReDoS, CVSS 4.8 Medium).
This PR closes the remaining downstream-consumer gap so a fresh
`pip install aignostics` / `uv add aignostics` / `uvx aignostics` cannot
resolve `pygments<2.20.0` transitively via rich.

The new lower bound (>=2.20.0) is <= the currently-locked version
(2.20.0), so no dependency is upgraded — uv.lock diff is metadata-only
(adds the new specifier and the dependency edge); no [[package]]
version block changed.

Resolves PYSDK-106.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: helmut-hoffer-von-ankershoffen

pyproject.toml

@@ -138,6 +138,7 @@ dependencies = [
     "lxml>=6.1.0",                      # CVE-2026-41066 (Renovate #556); also required for python 3.14 pre-built wheels
     "filelock>=3.20.3",                 # CVE-2025-68146 (>=3.20.1); CVE-2026-22701 (>=3.20.3, Renovate #387)
     "marshmallow>=3.26.2",              # CVE-2025-68480
+    "pygments>=2.20.0",                 # CVE-2026-4539 (>=2.20.0); transitive via rich
     "cryptography>=46.0.7",             # CVE-2026-39892 (>=46.0.7); transitive via pyjwt[crypto]
     "pydicom>=3.0.2",                   # CVE-2026-32711 (>=3.0.2); transitive via dicomweb-client/wsidicom/highdicom
     "pyasn1>=0.6.3",                    # CVE-2026-30922 (>=0.6.3); transitive via cryptography