Relax msgpack and tornado dependency caps

Raise the upper bounds on msgpack (<=1.1.2 -> <=1.2.1) and tornado
(<=6.5.5 -> <=6.5.7) so downstream consumers (citus regress tests) can
pick up security-relevant patch releases while still pinning mitmproxy
to a controlled range. Consistent with the fork's existing relaxations
of urwid and cryptography.

Verified: a real `pipenv lock` of the citus src/test/regress/Pipfile
with mitmproxy pointed at this change resolves msgpack==1.2.1 and
tornado==6.5.7 while preserving the cryptography==46.0.7 pin.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: cap experiment

pyproject.toml

@@ -45,14 +45,14 @@ dependencies = [
     "kaitaistruct>=0.10,<=0.11",
     "ldap3>=2.8,<=2.9.1",
     "mitmproxy_rs>=0.12.6,<0.13",  # relaxed upper bound here: we control this
-    "msgpack>=1.0.0,<=1.1.2",
+    "msgpack>=1.0.0,<=1.2.1",
     "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'",
     "pyOpenSSL>=24.3,<=27.0.0",
     "pyparsing>=2.4.2,<=3.3.2",
     "pyperclip>=1.9.0,<=1.11.0",
     "ruamel.yaml>=0.18.10,<=0.19.1",
     "sortedcontainers>=2.3,<=2.4.0",
-    "tornado>=6.5.0,<=6.5.5",
+    "tornado>=6.5.0,<=6.5.7",
     "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'",
     "urwid>=2.6.14,<=4.0.0",
     "wsproto>=1.0,<=1.3.2",