[jipeng6036-del]

Fixes #691

I raised the minimum versions to anyio>=4.14.2 and aiohttp>=3.14.4, so Taskiq can no longer resolve to versions affected by the reported advisories. I also refreshed the lockfile to AnyIO 4.15.1 and aiohttp 3.14.5, with their required transitive updates. Python 3.10 remains supported.

AnyIO 4.14.2 fixes CVE-2026-63374, CVE-2026-63349, and CVE-2026-64847. The aiohttp floor includes the fixes in the 3.14.4 security release.

Validation against baseline f08a54a and candidate ac39c199:

• Full suite on Windows/Python 3.13.1 with the old and updated lockfiles: 370 passed, 1 skipped on each.
• Full suite on Windows/Python 3.10.20 with the exact minimum versions (AnyIO 4.14.2 / aiohttp 3.14.4): 370 passed, 1 skipped; dependency consistency check passed.
• Real local InMemoryBroker task execution with a timeout and TaskiqAdminMiddleware HTTP calls to a loopback aiohttp server: result 5, all three lifecycle events received, and the client closed, with both the old and new dependencies and with the minimum versions.
• uv lock --check, wheel/sdist build, and installed dependency metadata checks passed.
• The original lint job and Ubuntu/Windows/macOS × Python 3.10–3.14 matrix all passed (16 successful jobs) in this fork run. Each matrix job actually ran the full suite: 373 passed on Ubuntu, 371 passed on macOS, and 370 passed / 1 skipped on Windows. Its verification workflow checks out candidate ac39c199e939bf843c95d03b33f1aa8a9ce2eaca; the workflow-only harness changes are not part of this PR.

The full local hooks pass except for detect-secrets flagging three existing documentation badges through Windows path handling; the exact unmodified baseline has the same result. The changed files pass that hook. No exploit reproduction or live external service call is claimed.