Unblock security dependency updates and retire Bullseye

[ibrahim halatci (ihalatci)]

Summary

Unblock Citus's dependency-security-sync while preserving the fork's TCP-kill behavior and the existing msgpack cap relaxation.

Dependency	Previous upper bound	New upper bound
msgpack	1.1.2	1.2.1
tornado	6.5.5	6.5.8
h2	4.3.0	4.4.1
cryptography	48.1	50.0.0

The cryptography, h2 and tornado bounds match current upstream support. Synchronize the corresponding uv.lock dependency metadata without changing unrelated resolved versions or importing upstream wholesale.

Cryptography 50 uses OpenSSL 4, which can reject SSL3 during protocol configuration rather than the handshake. Extend the existing narrow SSL.Error handling in is_supported_version to cover that configuration step, preserving the unsupported-version=false contract. Add deterministic regression coverage for both protocol setters; context construction and cipher configuration remain outside the catch.

Replace both Linux standalone-build containers (x86_64 and ARM64) from Debian 11/Bullseye to Debian 12/Bookworm. This removes the expired Bullseye repository failure without bypassing apt freshness or signature checks. The changelog records the supported standalone-binary glibc baseline moving from 2.31 to 2.36. Release Docker images already use Trixie and are unchanged.

Coordinated downstream updates

• Generated image requirements: Automated requirements sync for Dependabot security alerts the-process#249
• Generated Citus dependency updates: Automated security dependency sync from Dependabot alerts citus#8841 (includes the prerequisite pin from Advance mitmproxy pin to unblock security dependency sync citus#8840)
• Successful security-sync run: https://github.com/citusdata/the-process/actions/runs/34461452342

Citus consumes runtime-fix commit a16444362cc0393ccf7329f50fc909b711729de7. The later Bookworm commit changes only CI/changelog, so no further runtime-pin churn is needed. Merge the the-process requirements PR before the generated Citus dependency PR so the post-merge workflow can advance Citus to the release-image tag. No PRs have been merged by this work.

Validation

• WSL Ubuntu-22.04, Python 3.12; focused TCP/TCP-kill, TLS, HTTP/2, certificate and Tornado/web suites: 199 passed, 1 platform skip on both the original locked environment and an environment using cryptography 50.0.0, h2 4.4.1 and tornado 6.5.8.
• Lock consistency and dependency checks pass in both environments; patched mitmdump starts with OpenSSL 4.0.1.
• Actual security-sync workflow addressed all three packages across both dependency trees and generated both downstream PRs.
• Bookworm push CI completed successfully: https://github.com/citusdata/mitmproxy/actions/runs/34461400099

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[autofix-troubleshooter]

Hi! I'm the autofix.ci troubleshooter bot.

It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the autofix.ci GitHub App has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃