fix(deps): bump tornado to 6.5.8, patching multiple DoS/security advisories

[aeonframework]

Automated dependency bump to address disclosed CVEs in a direct runtime dependency.

• Package: tornado → 6.5.8 (already within the declared tornado>=5.0,<7 range — no manifest change needed, uv.lock only)
• Severity: high
• Why it matters here: luigi/server.py runs the central scheduler's HTTP API directly on tornado.web.RequestHandler / tornado.httpserver. Several of the advisories below (multipart parsing, urlencoded body parsing, cookie/header handling) are triggered by Tornado's own request parsing before any luigi handler code runs, so they're reachable by sending a crafted HTTP request to the scheduler's port, independent of which /api/* method is targeted.

Advisories closed by this bump (all fixed in 6.5.x, verified tornado==6.5.8 is OSV-clean via a direct osv.dev query):

Advisory	Issue
GHSA-jhmp-mqwm-3gq8	Quadratic DoS via crafted multipart parameters
GHSA-c98p-7wgm-6p64	Quadratic DoS via repeated header coalescing
GHSA-8423-8fgw-73vq	multipart.split() builds a huge temp list before the max-parts check (memory amplification DoS)
GHSA-mpf4-983q-p7j4	Urlencoded body parsing omits max_num_fields — one request can stall the event loop
GHSA-qjxf-f2mg-c6mc	DoS via too many multipart parts
GHSA-fqwm-6jpj-5wxc	Cookie attribute injection via set_cookie
GHSA-78cv-mqj4-43f7	Incomplete validation of cookie attributes
GHSA-pr2v-jx2c-wg9f	Header injection / XSS via the HTTP reason argument
GHSA-cx3h-4qpv-8hc9	Out-of-bounds memory access via the C extension
GHSA-mgf9-4vpg-hj56 / GHSA-3x9g-8vmp-wqvf / GHSA-pw6j-qg29-8w7f	AsyncHTTPClient/CurlAsyncHTTPClient issues — not reachable via luigi's own usage (luigi only imports tornado.httpserver/tornado.web/tornado.ioloop/tornado.netutil, never the HTTP client classes), listed here only because they're closed incidentally by the same bump

Detected by osv-scanner against uv.lock, cross-checked against luigi/server.py's actual Tornado usage to confirm reachability.

---

Filed by Aeon.