deps(python): update jwcrypto requirement from >=1.5.6 to >=1.6.0

[dependabot]

Updates the requirements on jwcrypto to permit the latest version.

Release notes

Sourced from jwcrypto's releases.

Version 1.6.0

Security release

This release fixes CVE-2026-84185, a low security issue that affects only very specific and uncommon uses of the JWS interface using a JWKSet.

What's Changed

• Fix an issue with parsing headers with 'kid' by @​simo5 in latchset/jwcrypto#395
• Version 1.6.0 by @​simo5 in latchset/jwcrypto#396

Full Changelog: latchset/jwcrypto@v1.5.9...v1.6.0

Commits

• 48f1e80 Version 1.6.0
• 746edb9 Handle multiple recipients in JWE decryption
• 268f4bc Use checked headers to find kid in JWKSet
• d2e980d Version 1.5.9
• 1a7737d Limit dot splits during JWE and JWS parsing
• ca10b40 Reject non-empty encrypted key in bare ECDH-ES
• 9a2850c Skip unknown kty in JWKSet import per RFC 7517 §5
• 9c33155 Add tests for RFC 9864 EdDSA deprecation
• c4b94b3 Add support for fully specified EdDSA algorithms per RFC 9864
• 094e746 Drop Python 3.8 and add 3.12, 3.13, 3.14 support
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[gonzalesedwin1123]

@dependabot rebase

[gonzalesedwin1123]

Closing. This cannot be merged, and the upgrade it proposes is blocked upstream of this repo:

1. The diff is invalid. The root requirements.txt is generated from module manifests (see its first line). Dependabot rewrote it into jwcrypto>=1.6.0>=1.5.6, which the build rejects at parse time (see this PR's own CI: Couldn't parse requirement in /tmp/manifest-requirements.txt). Any hand edit would be undone by the generator; the floor lives in spp_encryption/__manifest__.py.
2. The floor is unsatisfiable. jwcrypto 1.5.9 and 1.6.0 require cryptography>=49.0.0. Odoo 19's requirements.txt pins cryptography==42.0.8, and the Dockerfile feeds that file to the resolver, which is why the current image installs jwcrypto 1.5.8. A >=1.6.0 floor makes the build unresolvable.
3. No exposure. CVE-2026-84185 (low) affects JWS verification through a JWKSet. Our jwcrypto consumers (spp_encryption, spp_key_management, spp_claim_169) use single-key jwt.JWT and jwk.JWK only; none touch JWKSet or the JWS interface directly.

Upgrading jwcrypto means deliberately overriding Odoo's cryptography pin in docker/requirements.txt, which is a separate, tested change rather than a dependabot merge.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.