ci(google-auth): separate core vs extras lower-bound constraints

[ohmayr]

Core vs. Extras Constraints Separation:

• constraints-*.txt: Core lower bounds only (pyasn1-modules, cryptography).
• constraints-extras-*.txt: Extras lower bounds (aiohttp, grpcio, requests, pyjwt, urllib3, packaging, rsa, etc.).

[gemini-code-assist]

Code Review

This pull request updates the minimum required version of pyopenssl to 23.2.0 in setup.py and introduces a new constraints file for Python 3.14. The review feedback correctly identifies a dependency resolution conflict in the new constraints file, where pyopenssl 23.2.0 requires cryptography >= 41.0.1, but cryptography is currently pinned to 38.0.3. It is recommended to update the cryptography version to avoid installation failures.

[daniel-sanche]

Isn't adding these extras (and oauthlib above) redundant, since the constraints-extas.txt file also contains them? Is there a benefit to installing them this way too? If so, should we be doing this for all extras?

[ohmayr]

A -c constraints.txt file only constrains package versions for packages that pip is already installing; it does not trigger installation of any package by itself.

[daniel-sanche]

We discussed this offline, and found that new constraints files shouldn't be needed. We should be able to list all the constraints in a single place