chore(deps): bump dependencies to clear security advisories

[jimsynz]

Refreshes mix.lock to clear the security advisories reported by mix hex.audit / mix deps.audit, which currently fail the audit step in CI.

mix.lock | 8 ++++----

mix.lock only — no mix.exs or source changes. Every bump is already permitted by the existing version constraints.

Notes on the two indirect unblocks, where they apply:

• doctor 0.22 -> 0.23 is required to reach decimal 3.x; older doctor pins decimal ~> 2.0. mix.exs declares ~> 0.21, which already allows 0.23.
• req_s3 0.2.3 -> 0.2.5 is required to reach req 0.7; older req_s3 pins req ~> 0.5.6.

mix hex.audit reports no advisories on this branch.