[security] Bump starlette to 1.2.1 in aspire-with-python sample

[IEvangelist]

Resolves the open Dependabot alert on samples/aspire-with-python/app/uv.lock:

Alert	Severity	Advisory	Package	Summary
#484	medium	GHSA-86qp-5c8j-p5mr	starlette	Missing Host header validation poisons request.url.path, bypassing path-based security checks

starlette is a transitive dependency in this sample (pulled in via fastapi[standard]), so only the lockfile changes.

Change

• starlette 0.49.3 -> 1.2.1 (patched in 1.0.1; bumped to latest)

Generated with:

uv lock --upgrade-package starlette

The resolver only updated starlette; no other package versions changed.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[IEvangelist]

Reviewed the security fix and the failing CI:

Change scope — single-file edit to samples/aspire-with-python/app/uv.lock bumping the transitive starlette dep from 0.49.3 → 1.2.1 (patched in 1.0.1, per GHSA-86qp-5c8j-p5mr). The resolver only touched starlette; no collateral version drift.

CI — windows-latest is green. ubuntu-latest fails on SamplesIntegrationTests.AppHostTests.{AppHostRunsCleanly,TestEndpointsReturnOk} for AspireJavaScript.AppHost because the angular resource fails to start. This failure is unrelated to the Python sample touched here and reproduces on main (e.g. run 26966407089 on main shows the same two tests failing for the same reason). Skipping a CI re-run since it would just hit the same pre-existing flake.

LGTM for the security fix. The angular flake on Linux should be tracked separately.