open-webui: update aiohttp to v3.13.3 to remediate several CVEs

[brianmcarey]

aiohttp v3.13.3 addresses:

• GHSA-54jq-c3m8-4m76
• GHSA-54jq-c3m8-4m76
• GHSA-6jhg-hg63-jvvf
• GHSA-6mq8-rvhq-8wgg
• GHSA-fh55-r93g-j68g
• GHSA-g84x-mcqj-x9qq
• GHSA-jj3x-wxrx-4x23
• GHSA-mqqc-3gqh-h2x8

[brianmcarey]

The CI CVE scan failed to scan but here is a local scan of the presubmit APKs:

wolfictl scan open-webui-*
🔎 Scanning "open-webui-0.6.43-r1-aarch64.apk"
├── 📄 /usr/share/open-webui/lib/python3.11/site-packages/ecdsa-0.19.1.dist-info/METADATA
│       📦 ecdsa 0.19.1 (python)
│           High CVE-2024-23342 GHSA-wj6h-64fc-37mp
├── 📄 /usr/share/open-webui/lib/python3.11/site-packages/open_webui/frontend/pyodide/fonttools-4.56.0-py3-none-any.whl
│       📦 fonttools 4.56.0 (python)
│           Medium CVE-2025-66034 GHSA-768j-98cg-p3fv fixed in 4.60.2
└── 📄 /usr/share/open-webui/lib/python3.11/site-packages/open_webui/frontend/pyodide/urllib3-2.5.0-py3-none-any.whl
        📦 urllib3 2.5.0 (python)
            High CVE-2025-66471 GHSA-2xpw-w6gg-jr37 fixed in 2.6.0
            High CVE-2025-66418 GHSA-gm62-xv2j-4w53 fixed in 2.6.0

🔎 Scanning "open-webui-0.6.43-r1-x86_64.apk"
├── 📄 /usr/share/open-webui/lib/python3.11/site-packages/ecdsa-0.19.1.dist-info/METADATA
│       📦 ecdsa 0.19.1 (python)
│           High CVE-2024-23342 GHSA-wj6h-64fc-37mp
├── 📄 /usr/share/open-webui/lib/python3.11/site-packages/open_webui/frontend/pyodide/fonttools-4.56.0-py3-none-any.whl
│       📦 fonttools 4.56.0 (python)
│           Medium CVE-2025-66034 GHSA-768j-98cg-p3fv fixed in 4.60.2
└── 📄 /usr/share/open-webui/lib/python3.11/site-packages/open_webui/frontend/pyodide/urllib3-2.5.0-py3-none-any.whl
        📦 urllib3 2.5.0 (python)
            High CVE-2025-66471 GHSA-2xpw-w6gg-jr37 fixed in 2.6.0
            High CVE-2025-66418 GHSA-gm62-xv2j-4w53 fixed in 2.6.0

🔎 Scanning "open-webui-compat-0.6.43-r1-aarch64.apk"
✅ No vulnerabilities found
🔎 Scanning "open-webui-compat-0.6.43-r1-x86_64.apk"
✅ No vulnerabilities found

The vulnerabilities in question are no longer present