chore(deps): consolidate open dependabot dependency updates

[Jingjing Jia (jingjingjia-ms)]

Summary

Consolidates the open Dependabot dependency updates into one PR.

requirements-dev.txt

Package	From	To	Source PR
aiohttp	3.13.5	3.14.1	#1103, #1089
anyio	4.13.0	4.14.1	#1103
certifi	2026.5.20	2026.6.17	#1103
cffi	2.0.0	2.1.0	#1103
click	8.4.1	8.4.2	#1103
cryptography	48.0.0	49.0.0	#1103, #1091
hpack	4.1.0	4.2.0	#1103
idna	3.17	3.18	#1103
msal	1.36.0	1.37.0	#1103
mypy	2.1.0	2.2.0	#1103
typing_extensions	4.15.0	4.16.0	#1103
wrapt	2.2.1	2.2.2	#1103
opentelemetry-api	1.42.1	1.43.0	#1095
opentelemetry-sdk	1.42.1	1.43.0	#1095
opentelemetry-semantic-conventions	0.63b1	0.64b0	#1095
flit	3.10.0	3.12.0	#1086
flit_core	3.10.0	3.12.0	#1086
microsoft-kiota-abstractions	1.10.2	1.11.6	#1081
microsoft-kiota-authentication-azure	1.10.2	1.11.6	#1081
microsoft-kiota-http	1.10.2	1.11.6	#1081
microsoft-kiota-serialization-form	1.10.2	1.11.6	#1081
microsoft-kiota-serialization-json	1.10.2	1.11.6	#1081
microsoft-kiota-serialization-multipart	1.10.2	1.11.6	#1081
microsoft-kiota-serialization-text	1.10.2	1.11.6	#1081

GitHub Actions

Package	From	To	Source PR
actions/checkout	v6	v7	#1092

Notes

• Local validation passed: python -m venv .venv, then .\.venv\Scripts\pip install -r requirements-dev.txt.
• Left out / needs manual attention: none.

Closes#1103
Closes#1095
Closes#1092
Closes#1091
Closes#1089
Closes#1086
Closes#1081

Excluded pylint group #1087 (astroid + pylint): Dependabot pairs astroid==4.1.2 with pylint==4.0.6, but pylint 4.0.6 requires astroid<=4.1.dev0 — unresolvable. Group PRs are all-or-nothing, so the whole group is left out (astroid/pylint stay at main values) and #1087 remains a standalone Dependabot PR.