chore(deps): apply transitive security updates

[FreeOnePlus]

Summary

• update the locked Marshmallow transitive dependency from 4.0.0 to 4.1.2 to address CVE-2025-68480
• update the locked Virtualenv transitive dependency from 20.31.2 to 20.36.1 to include the symlink-based TOCTOU hardening
• document both security-related dependency updates under Unreleased
• supersede Dependabot PRs chore(deps): bump marshmallow from 4.0.0 to 4.1.2 #215 and chore(deps): bump virtualenv from 20.31.2 to 20.36.1 #216 with one reviewed lockfile change

Validation

• uv lock --check
• uv sync --locked --all-groups
• ruff check .
• mypy doris_mcp_server
• bandit -q -c pyproject.toml -r doris_mcp_server
• python generate_tool_catalog.py --check
• pytest -q -W error: 1859 passed, 85 skipped, 68.11% coverage
• built sdist and wheel successfully
• inspected release archives for excluded ledger, audit-report, and environment files
• installed the wheel into a clean Python 3.12 environment and verified package and CLI version 1.0.0

No runtime code or direct dependency constraint was changed.