Fix: Bump json-repair to 0.60.1 to clear dependency-review DoS finding

The dependency-review check flagged json-repair@0.25.3 (transitive via crewai
in the github_agent demo) for GHSA-xf7x-x43h-rpqh (high, unbounded-CPU DoS via
circular JSON Schema $ref). Patched in 0.60.1. Pin it in pyproject.toml
following the existing indirect-dep pattern and refresh uv.lock (also pulls
minor crewai 1.15.2->1.15.8, mcp, pydantic-settings bumps from re-resolution).

chromadb (CVE-2026-45829, no patched version) remains allowlisted via
allow-ghsas in security-scans.yaml.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Oleg Blinder <oblinder@gmail.com>

Author: oblinder

aiac/demo/agents/github_agent/pyproject.toml

@@ -20,6 +20,7 @@ dependencies = [
     "pillow>=12.3.0",           # Indirect; prevents CVE-2026-40192
     "lxml>=6.1.1",              # Indirect; prevents CVE-2026-41066
     "orjson>=3.11.6",           # Indirect; prevents CVE-2025-67221
+    "json-repair>=0.60.1",      # Indirect (via crewai); prevents GHSA-xf7x-x43h-rpqh (DoS)
     # CVE-2026-45829 (chromadb): no fixed version published; crewai pins chromadb<1.2.
     # Vulnerability requires running a chromadb HTTP server with trust_remote_code=true,
     # which this agent does not do.