chore: bump starlette version (backport #4158)

[mergify]

What does this PR do?

Require at least 0.49.1 which fixes a security vulnerability in the parsing logic of the Range header in FileResponse. Release note: https://github.com/Kludex/starlette/releases/tag/0.49.1

---

This is an automatic backport of pull request #4158 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of dc49ad3 has failed:

On branch mergify/bp/release-0.3.x/pr-4158
Your branch is up to date with 'origin/release-0.3.x'.

You are currently cherry-picking commit dc49ad3f.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   pyproject.toml

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   uv.lock

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally