Floor dependency versions that carry published security advisories

[nataliamelissas]

mix deps.get on dev currently reports published advisories against 13 packages. Most of them
have a fix inside the version line the project already allows — resolution just is not required to
pick it, so a fresh mix deps.get can still land on the vulnerable version.

This raises the floors. No major upgrades: phoenix stays on 1.7, phoenix_live_view on 1.0.

Package	Lock before	After	Worst advisory cleared
cowboy (transitive)	2.13.0	2.18.0	EEF-CVE-2026-8466, HIGH — unbounded buffer accumulation in multipart header parsing (DoS), fixed in 2.15.0
plug (transitive)	1.18.1	1.18.5	EEF-CVE-2026-8468 and EEF-CVE-2026-54892, both HIGH
plug_cowboy	2.7.4	2.8.1	EEF-CVE-2026-32688, HIGH
phoenix	1.7.21	1.7.24	EEF-CVE-2026-32689 and EEF-CVE-2026-56811, both HIGH
phoenix_live_view	1.0.17	1.0.19	EEF-CVE-2026-64941
mint (transitive)	1.7.1	1.9.3	EEF-CVE-2026-49754, HIGH, and 7 more
hpax (transitive)	1.0.3	1.0.4	EEF-CVE-2026-58226, HIGH
oidcc	3.5.2	3.9.0	EEF-CVE-2026-75759, HIGH
req	0.5.14	0.6.3	EEF-CVE-2026-49755, HIGH
swoosh	1.19.3	1.26.3	EEF-CVE-2026-54893
postgrex	0.20.0	0.22.4	EEF-CVE-2026-32687, HIGH — SQL injection via channel name in Postgrex.Notifications.listen/3

postgrex is the one that needed its requirement widened rather than floored: ~> 0.20.0 pins the
0.20 line, and the fix is in 0.22.2.

req 0.5 to 0.6 is the only change that crosses a minor version. It is used in
Claper.Transcriptions.VoxtralClient and the LTI 1.3 modules, all through Req.get/2,
Req.post/2 and %Req.Response{}, which are unchanged across that boundary.

Two advisories are left after this and neither has a version to move to:

• cowlib — three advisories in the header encoders, with no fixed release published.
• decimal — EEF-CVE-2026-32686 is fixed in 3.0.0, a major the ecto stack does not support yet.

mix test (338 tests), mix credo and mix format all pass on this branch.