Relax urllib3 pin to >=1.26.18,<3.0a (allows CVE-fixed 2.7.0+)

[Architect203]

Defect

https://buildtools1.service-now.com/x_snc_defect_defect.do?sys_id=7b81a663837a435014977f647daad388&sysparm_stack=x_snc_defect_defect_list.do?sysparm_query=active=true

Problem

The current pin urllib3>=1.15,<2.0a in setup.py hard-blocks installing
urllib3 2.x alongside this SDK, preventing users from upgrading to
security-patched versions.

This range includes urllib3 versions affected by several known CVEs:

• CVE-2023-43804 (Cookie header leak on cross-origin redirect)
• CVE-2023-45803 (Proxy-Authorization header leak on redirect)
• CVE-2024-37891 (proxy header leak)
• CVE-2025-66418 / GHSA-gm62-xv2j-4w53 (unbounded decompression chain, DoS)
  — fixed specifically in urllib3 2.7.0

Change

Relaxed the pin to urllib3>=1.26.18,<3.0a, which:

• keeps 1.x support for environments still pinned to that major line,
  but only the already-patched 1.26.18+
• allows the full 2.x line, including 2.7.0+

Testing

Ran the full test suite on Python 3.11 with urllib3==2.7.0 installed:
182 passed, 1 skipped, no failures.