Update Python packages to patch security issues reported by Dependabot

[eecavanna]

In this branch, I updated some Python packages in order to get some security patches.

Details

I updated the python-multipart package specification in main.in to ensure the version that gets installed includes a security patch. This update was prompted by Dependabot alert 8; i.e. https://github.com/microbiomedata/nmdc-runtime/security/dependabot/8.

After updating that package, I synchronized the transitive dependencies and confirmed that tornado (which is a transitive dependency, not a direct one) was updated to version 6.4.2, which is what Dependabot recommended in its alert 7; i.e. https://github.com/microbiomedata/nmdc-runtime/security/dependabot/7.

Related issue(s)

• Fixes Dependabot alerts 7 and 8
• Makes Dependabot's PR Bump tornado from 6.4.1 to 6.4.2 in /requirements #798 obsolete
• Makes Dependabot's PR Bump python-multipart from 0.0.17 to 0.0.18 in /requirements #814 obsolete

Related subsystem(s)

• Runtime API (except the Minter)
• Minter
• Dagster
• Project documentation (in the docs directory)
• Translators (metadata ingest pipelines)
• MongoDB migrations
• Other

Dependencies. I think a bunch of applications in this repo share the same dependency list. I am not sure which things use these particular packages. I assume it's at least the Runtime API.

Testing

• I tested these changes (explain below)
• I did not test these changes

I will leave this to the GitHub Actions workflows.

Documentation

• I have not checked for relevant documentation yet (e.g. in the docs directory)
• I have updated all relevant documentation so it will remain accurate
• Other (explain below)

Maintainability

• Every Python function I defined includes a docstring (test functions are exempt from this)
• Every Python function parameter I introduced includes a type hint (e.g. study_id: str)
• All "to do" or "fix me" Python comments I added begin with either # TODO or # FIXME
• I used black to format all the Python files I created/modified
• The PR title is in the imperative mood (e.g. "Do X") and not the declarative mood (e.g. "Does X" or "Did X")

[eecavanna]

The command I used to "sync deps" was:

docker compose run --rm -it --no-deps fastapi make update-deps

That saved me from having to spin up the entire Docker Compose stack.

[eecavanna]

Merging security-related bumps to dependency versions before Monday's freeze of main.