fix: bump garminconnect for CVE-2026-54447

[ivni]

Summary

• require garminconnect>=0.3.5 to exclude versions affected by CVE-2026-54447
• refresh the lock file from garminconnect 0.3.3 to 0.3.6
• document remediation guidance for OAuth token stores created by an affected version

Why

garminconnect<=0.3.4 could create garmin_tokens.json with permissions that
allowed other local users to read the OAuth refresh token on a multi-user Unix
system. Version 0.3.5 hardened the token directory and file permissions.

Existing token files are not secured until the library rewrites them, so the
changelog also advises users to restrict permissions or re-authenticate if a
token may have been exposed.

Verification

• uv lock --check --offline
• python -m pytest — 58 passed
• ruff check .
• ruff format --check . — 34 files already formatted
• python -m pyright — 0 errors