Fix dependencies (#6333)

Fixes #6332 

- Promotes `packaging` from a release-only dependency to a required
runtime dependency by moving it into `pyproject.toml`'s main
dependencies.

- Updates `poetry.lock` to pick up patched versions of vulnerable
libraries, notably `brotli` (`1.1.0` → `1.2.0`), `urllib3` (`2.5.0` →
`2.6.3`), `werkzeug` (`3.1.3` → `3.1.5`), and `filelock` (`3.20.2` →
`3.20.3`).

<img width="442" height="169" alt="image"
src="https://github.com/user-attachments/assets/fe70475e-0163-4d45-b1e4-362008669c00"
/>

Author: snejus

docs/changelog.rst

@@ -7,13 +7,9 @@ below!
 Unreleased
 ----------
 
-New features:
-
 Bug fixes:
 
-For packagers:
-
-Other changes:
+- Make ``packaging`` a required dependency. :bug:`6332`
 
 2.6.0 (February 01, 2026)
 -------------------------