fix(deps): update PyJWT and source-map-js for security advisories

[eous]

The security and security-ts audit jobs now fail on every PR to main (first seen on #1289), because advisories were published after main's last green run on 09-25:

• PyJWT 2.13.0: 14 advisories (PYSEC-2026-4140 through 4152 and CVE-2026-102275), fixed in 2.14.0 and 2.15.0.
• source-map-js 1.2.1: high-severity event-loop denial of service (GHSA-68fv-2mgg-jv7q), fixed in 1.2.2.

dev already locks PyJWT 2.15.1 and source-map-js 1.2.2 through its lock-file maintenance commits. Those commits bump many other packages too, so instead of cherry-picking them this bumps only the two locked versions on the 1.8 line. The pyproject.toml range (PyJWT>=2.8) and package.json are unchanged.

• uv.lock: uv lock --upgrade-package pyjwt; PyJWT is the only package that changes.
• sdk/typescript/package-lock.json: the source-map-js entry's version, URL and integrity only; the integrity was checked against the npm registry. Its parent requires ^1.2.1.

Checked on this branch, in an environment built from its lockfile:

• CI's audit command (uv export --no-emit-project --frozen | pip-audit --strict --desc) finds no known vulnerabilities; npm audit --audit-level=moderate finds 0.
• The JWT, auth, OIDC, console and coordinator-auth tests pass with PyJWT 2.15.1 (841).
• npm ci installs source-map-js 1.2.2 and the TypeScript SDK's tests pass (85).

Once this merges, #1289 needs main merged in (or its checks re-triggered on a fresh merge ref) to pick it up.