dspy 3.2.0 caps litellm at <=1.82.6 (CVE-2026-35030) — please cut a patch release including PR #9687

## Summary `dspy==3.2.0` (the current PyPI release) hard-caps litellm at `<=1.82.6`: ``` litellm<=1.82.6,>=1.64.0 ``` `litellm<=1.82.6` is affected by **CVE-2026-35030** (CRITICAL — authentication bypass via OIDC userinfo cache key collision). The fix is in `litellm>=1.83.0`. ## What's already fixed on main PR #9687 (_"chore(deps): remove litellm upper bound"_) was merged on **April 28 2026** and removes the cap entirely. However, no release has been cut since then — `3.2.0` (April 21) is still the latest on PyPI. ## Impact Any project that depends on `dspy==3.2.0` and runs a security scanner (Trivy, Snyk, Dependabot, etc.) will get a CRITICAL flag for CVE-2026-35030 with no way to resolve it within the `3.2.x` release line. ## Request Could a `3.2.1` patch release (or `3.3.0`) be cut that includes the fix from PR #9687? That would allow `litellm>=1.83.0` to resolve and clear the CVE for downstream users without requiring them to downgrade to `3.1.x`. ## Workaround (until the release) Downgrade to `dspy==3.1.3`, which has no upper bound on litellm and resolves to `1.83.0+` cleanly.