Bump Brotli to address CVE-2026-111497 (#16759)

CVE-2026-111497 - Bump Brotli to 1.2.1

Add Brotli>=1.2.1 pin to requirements.in to address CVE-2026-111497
(Out-of-Bounds Write in Google Brotli Decoder).
Regenerated requirements.txt via make docker_update_requirements.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jake Jackson <24478650+thedoubl3j@users.noreply.github.com>

requirements/requirements.in

@@ -6,6 +6,7 @@ azure-identity
 azure-keyvault
 boto3
 botocore
+Brotli>=1.2.1  # CVE-2026-111497, required by aiohttp[speedups]
 cachetools  # Used by awx/conf/settings.py for TTLCache
 channels
 channels-redis

requirements/requirements.txt

@@ -76,8 +76,10 @@ botocore==1.40.46
     #   -r /awx_devel/requirements/requirements.in
     #   boto3
     #   s3transfer
-brotli==1.2.0
-    # via aiohttp
+brotli==1.2.1
+    # via
+    #   -r /awx_devel/requirements/requirements.in
+    #   aiohttp
 cachetools==6.2.0
     # via -r /awx_devel/requirements/requirements.in
 # certifi @ git+https://github.com/ansible/system-certifi.git@devel  # git requirements installed separately