Bump PyJWT to address CVE-2026-102268 (#16748)

* Bump PyJWT to address CVE-2026-102268

Pin PyJWT>=2.14.0 in requirements.in to address CVE-2026-102268
(authentication bypass via improper public key validation).
Regenerated requirements.txt via make docker_update_requirements.

Assisted-By: Claude Code
Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>

* Use a 32+ byte HMAC key in workload identity tests

PyJWT >= 2.11 emits InsecureKeyLengthWarning for HS256 keys shorter
than 32 bytes, which pytest's filterwarnings=error turns into an
exception that populate_workload_identity_tokens swallows, so the
Gateway request is never made.

Assisted-By: Claude Code
Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>

---------

Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>

requirements/requirements.in

@@ -49,6 +49,7 @@ psutil
 pyasn1>=0.6.2  # CVE-2026-2349
 pygerduty
 PyGithub
+PyJWT>=2.14.0  # CVE-2026-102268
 pyopenssl
 pyparsing>3.0 # Upgraded to v3 and changed import patterns
 python-daemon

requirements/requirements.txt

@@ -384,8 +384,9 @@ pygithub==2.8.1
     # via
     #   -r /awx_devel/requirements/requirements.in
     #   awx-plugins-core
-pyjwt[crypto]==2.10.1
+pyjwt[crypto]==2.15.1
     # via
+    #   -r /awx_devel/requirements/requirements.in
     #   adal
     #   django-ansible-base
     #   msal