Upgrade cryptography to 50.0.0

[IlonaShishov]

Summary

Upgrade cryptography from >=48.0.1 to >=50.0.0 to address one High-severity CVE:

• CVE-2026-69247 (CVSS 8.2 High) — Bleichenbacher oracle in PKCS#7 decryption (pkcs7_decrypt_der, pkcs7_decrypt_pem, pkcs7_decrypt_smime). During Content Encryption Key (CEK) decryption using RSA PKCS#1 v1.5 padding, differences in error classification and symmetric execution timing allow a remote unauthenticated attacker to reconstruct plaintext keys.

Impact on this project: Low. This project uses cryptography only for x509 certificate parsing, serialization, and Fernet symmetric encryption — none of the affected PKCS#7 decryption APIs are called.

Breaking changes in cryptography 50.0.0:

• 32-bit Windows and x86_64 macOS wheel support removed (no impact — we deploy on Linux)
• Deprecated type aliases removed (PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES, etc.) — not used in this project
• ChaCha20 nonce handling changed to RFC 7539 — not used in this project

Changes

• pyproject.toml: bump cryptography>=48.0.1 → cryptography>=50.0.0
• requirements-agent.txt, requirements-handler.txt, requirements-dev.txt: regenerated lock files

Test plan

• make lint — clean
• make test — 490 passed
• Verify Konflux build succeeds
• Verify pip-audit reports no findings for cryptography

🤖 Generated with Claude Code