fix: upgrade protobuf dependency chain

[mobasi-team]

Summary

• upgrade the protobuf runtime from 3.10.0 to 5.29.6
• replace the abandoned blackboxprotobuf dependency with maintained upstream package bbpb==1.4.2, which still exposes import blackboxprotobuf
• add a package-level protobuf runtime compatibility shim and regression tests so the vendored legacy *_pb2.py modules keep importing under the secure dependency set

Why

The repo was pulling in protobuf==3.10.0, which triggered high-severity advisories. A direct protobuf bump was blocked because the old blackboxprotobuf package hard-pinned protobuf==3.10.0.

Root Cause

• requirements.txt pinned a vulnerable protobuf version
• the legacy blackboxprotobuf package on PyPI was abandoned and locked to that vulnerable protobuf release
• ALEAPP also vendors old generated protobuf modules that require the pure-Python protobuf runtime when used with modern protobuf releases

Validation

• python -m unittest admin.test.scripts.test_runtime_requirements.TestRuntimeRequirements.test_scripts_package_sets_protobuf_runtime_mode
• python -m unittest discover -s admin/test/scripts -p 'test_*.py' in fresh Python 3.11 environment
• python -m unittest discover -s admin/test/scripts -p 'test_*.py' in fresh Python 3.10 environment

Impact

• removes the vulnerable protobuf dependency chain from installs
• preserves existing blackboxprotobuf imports in artifact modules
• keeps the current vendored protobuf artifacts working without forcing a larger proto regeneration change in this PR

[mobasi-team]

@stark4n6 what is needed to get this merged?

We would love to patch up this last supply chain vuln given the axios + litellm stuff last few weeks

[stark4n6]

@mobasi-team I'm assuming if removing blackboxprotobuf from the requirements.txt we would need to update every single parser that uses that library?

[mobasi-team]

BBPB is the maintained version of blackboxprotobuf

[stark4n6]

@mobasi-team understood, but there is a lot of other work that will need to occur to update parsers to work with this (per @Johann-PLW). we are conferring on the best route forward

[mobasi-team]

@Johann-PLW @stark4n6 we took a first pass at the compatibility fixes. see the changes in most recent commit. Let us know what changes need to be made