Regenerate Pipfile.lock against Python 3.13

Pipfile.lock had drifted: the default and develop sections pinned
different versions of urllib3, protobuf and click, so Dependabot's
per-section bumps left the develop side vulnerable even after the
runtime side was patched. Regenerating resolves both sections from the
same solve.

Notable changes:
- resolves all remaining Python security advisories (urllib3 2.5.0
  -> 2.7.0, protobuf 6.31.1 -> 6.33.6, requests -> 2.34.2, idna -> 3.19,
  pytest -> 9.1.1, pygments -> 2.21.0, jaraco.context -> 6.1.2)
- drops 8 backport packages no longer needed on 3.13 (tomli,
  typing-extensions, exceptiongroup, importlib-metadata, zipp, pytz,
  tzdata, backports.tarfile)
- 74 -> 67 packages, 36 version changes, no prereleases
- no remaining version conflicts between default and develop

Also corrects the now-stale comment on the python-version pin: the
scipy/OpenBLAS problem it described is resolved by this refresh
(scipy 1.18.1 ships cp314 wheels). The pin stays so CI cannot drift
onto an interpreter the lockfile was never resolved against.

Author: caglarpir

.github/workflows/pytest.yml

@@ -16,9 +16,9 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        # Pinned rather than "3.x": Pipfile.lock pins scipy==1.15.3, which
-        # publishes wheels only up to cp313. On a newer interpreter pip falls
-        # back to the sdist, which needs OpenBLAS and fails on ubuntu-latest.
+        # Pinned rather than "3.x" so CI cannot drift onto an interpreter the
+        # lockfile has never been resolved against. Pipfile.lock is generated
+        # on this version; bump both together.
         python-version: "3.13"
     - name: Install dependencies
       run: |