deps: pin argon2-cffi-bindings to 25.1.0, see #9602

argon2-cffi-bindings 26.1.0 switched its build backend from setuptools to
scikit-build-core, which asks for cmake as a dynamic build requirement when
it does not find one on PATH. There are no cmake wheels for the BSDs and
OmniOS, so pip builds cmake from its sdist there - that takes about half an
hour and then fails on NetBSD, OpenBSD and OmniOS, so those VM test jobs
never get as far as running any test. On OmniOS the bootstrapped cmake has
no TLS support and can not even download the CMake tarball. FreeBSD gets
through it, but pays ~44 minutes for the privilege.

25.1.0 builds with setuptools + cffi and needs no cmake: it installs from
its sdist in seconds. It also still ships abi3 wheels for the platforms that
have them.

This is meant to be temporary: argon2 is moving to OpenSSL, which removes
the argon2-cffi dependency (and this pin) completely, see #9602.

pyproject.toml

@@ -37,6 +37,10 @@ dependencies = [
   "platformdirs >=3.0.0, <5.0.0; sys_platform == 'darwin'",  # for macOS: breaking changes in 3.0.0.
   "platformdirs >=2.6.0, <5.0.0; sys_platform != 'darwin'",  # for others: 2.6+ works consistently.
   "argon2-cffi",
+  # 26.x builds via scikit-build-core and thus needs cmake, which has no wheels for
+  # the BSDs / OmniOS - pip builds it from source there for ~30min, then fails.
+  # Temporary: argon2 is moving to OpenSSL, which drops argon2-cffi entirely, see #9602.
+  "argon2-cffi-bindings == 25.1.0",
   "shtab>=1.9.3",  # older versions generate broken zsh (tqdm/shtab#224) or fish (tqdm/shtab#227) completions
   "backports-zstd; python_version < '3.14'", # for python < 3.14.
   "jsonargparse>=4.47.0",