Bump up testing urllib3 version to >2.5.0

[benhoyt]

This is to fix a security issue. Currently only used by tests, so not critical.

Per discussion with Dima, this will likely require a bump to Python 3.10+.

[benhoyt]

Dima mentioned that requests is what pulls in urllib3, and that's only used in one integration test to fetch a URL. So simplest would be to update that test to use standard urllib, or possibly skip that test on Python 3.8.