python-urllib3: update to 2.6.3

- Fixed HTTPResponse.read_chunked() to properly handle leftover data
  in the decoder's buffer when reading compressed chunked responses.
- Fixed a security issue where decompression-bomb safeguards of the
  streaming API were bypassed when HTTP redirects were followed.
  (CVE-2026-21441)
- Started treating Retry-After times greater than 6 hours as 6 hours
  by default.
- Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten.

Release notes:
https://github.com/urllib3/urllib3/releases/tag/2.6.2
https://github.com/urllib3/urllib3/releases/tag/2.6.3

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>

Author: Yang-Wei-Ting

lang/python/python-urllib3/Makefile

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2007-2025 OpenWrt.org
+# Copyright (C) 2007-2026 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-urllib3
-PKG_VERSION:=2.6.1
+PKG_VERSION:=2.6.3
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
@@ -17,7 +17,7 @@ PKG_LICENSE_FILES:=LICENSE.txt
 PKG_CPE_ID:=cpe:/a:python:urllib3
 
 PYPI_NAME:=urllib3
-PKG_HASH:=5379eb6e1aba4088bae84f8242960017ec8d8e3decf30480b3a1abdaa9671a3f
+PKG_HASH:=1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed
 
 PKG_BUILD_DEPENDS:= \
 	python-hatch-vcs/host \