Support Python 3.9

[isc-dchui]

Description

• Closes Reduce the minimum Python requirement from 3.10 to 3.9 #1220
• Modifies the custom rdps.py
• Downgrades requests from 2.33.0 to 2.32.3
• Downgrades urllib3 from 2.7.0 to 2.6.3

On paper this re-introduces 4 CVEs from those two Python packages, but in practice neither IPM nor ORAS directly use the affected code, so the attack surface has not actually been increased.

Downgraded wheels: CVE analysis and risk assessment

Two wheels were downgraded to support Python 3.9:

Package	Old	New	Reason
urllib3	2.7.0	2.6.3	2.7.0 requires Python ≥3.10
requests	2.33.0	2.32.3	2.33.0 requires Python ≥3.10

CVEs reintroduced

urllib3 2.6.3

GHSA-qccp-gfcp-xxvc — Sensitive headers (Authorization, Cookie) forwarded across origins in cross-origin redirects. Requires ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) — the low-level API. ORAS uses requests (high-level), which strips these headers on redirect by default. Not reachable.
GHSA-mf9v-mfxr-j63j — Decompression bomb via streaming API (HTTPResponse.read(amt=N) or drain_conn() on partial reads). ORAS reads responses fully via requests, never touching the urllib3 streaming API directly. Not reachable.

requests 2.32.3

GHSA-9hjg-9r4m-mvj7 — .netrc credentials leaked when following cross-origin redirects. Not reachable. IPM passes credentials to ORAS via explicit auth= parameters; requests only falls back to .netrc when no explicit auth is provided. IPM has no .netrc integration and no code path that omits credentials on an authenticated request.
GHSA-gc5v-m9x4-r6x2 — Insecure temp file reuse in extract_zipped_paths(). This utility is not called by ORAS or IPM. Not reachable.

Summary

All four CVEs are not reachable through IPM's code paths. The urllib3 CVEs require direct use of the streaming or low-level proxy API, which ORAS never exercises. The requests CVEs require .netrc-based auth (IPM always passes credentials explicitly) or the extract_zipped_paths() utility (not called by ORAS or IPM).

Testing

Tested that this snapshot version installs on both a container running Python 3.9 and a local Windows IRIS 2024.1 instance running Python 3.9, with the integration tests running on the former. Tests also pass on a container running Python 3.12

Checklist

• This branch has the latest changes from the main branch rebased or merged.
• Changelog entry added.
• Unit (zpm test -only) and integration tests (zpm verify -only) pass.
• Style matches the style guide in the contributing guide.
• Documentation has been/will be updated
  • Source controlled docs, e.g. README.md, should be included in this PR and Wiki changes should be made after this PR is merged (add an extra issue for this if needed)
• Pull request correctly renders in the "Preview" tab.