fix: remediate litellm CVEs by upgrading from 1.82.5 to 1.84.0 (#17448)

## Summary
  
Remediates nine litellm CVEs (3 CRITICAL, 6 HIGH) by upgrading the exact
pin from `==1.82.5` to `==1.84.0` in `pyproject.toml`.
  
  | CVE | Severity | Fixed in |
  |---|---|---|
  | CVE-2026-35030 | CRITICAL | 1.83.0 |
  | CVE-2026-42208 | CRITICAL | 1.83.7 |
  | CVE-2026-49468 | CRITICAL | 1.84.0 |
  | CVE-2026-35029 | HIGH | 1.83.0 |
  | CVE-2026-40217 | HIGH | 1.83.10 |
  | CVE-2026-42203 | HIGH | 1.83.7 |
  | CVE-2026-42271 | HIGH | 1.83.7 |
  | CVE-2026-47101 | HIGH | 1.83.14 |
  | CVE-2026-47102 | HIGH | 1.83.10 |
  
`litellm` was pinned to `==1.82.5` because versions 1.82.6 - 1.82.8 had
a broken `litellm.caching.caching` import chain, and 1.88.0 had a broken
`litellm.integrations.custom_logger` import.
  Both issues are resolved in 1.84.0.
The exact pin is retained (rather than a range) due to litellm's history
of introducing regressions on minor bumps.

pyproject.toml

@@ -157,12 +157,11 @@ dependencies = [
     #    "xxhash>=3.5.0,<4.0.0",
     #    "trio>=0.17.0,<0.29.0",
     #    "click>=8.1.8",
-    # 1.88.0 ships a broken `litellm.integrations.custom_logger`
-    # (imports `AgenticLoopPlan` from a sibling types module where the
-    # symbol is missing — see PR #15952 CI run 27414495913), and the
-    # 1.82.6/1.82.7/1.82.8 minors have a broken `litellm.caching.caching`
-    # import chain. Pin to a single known-good 1.82.x release.
-    "litellm==1.82.5",
+    # litellm < 1.84.0 vulnerable to multiple CVE's. Previously pinned to 1.82.5 due to broken
+    # imports in 1.82.6–1.82.8 (caching) and 1.88.0 (custom_logger); both
+    # issues are resolved in 1.84.0. Exact pin retained due to litellm's
+    # history of introducing regressions on minor bumps.
+    "litellm==1.84.0",
     #    "pip>=25.2",
     #    "imageio-ffmpeg>=0.6.0",
     #    "cryptography==46.0.3",