Bump protobuf from 6.33.6 to 7.35.1

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.6 to 7.35.1.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 7.35.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

requirements/common.txt

@@ -10,7 +10,7 @@ py-cpuinfo
 transformers >= 5.5.3
 tokenizers >= 0.21.1  # Required for fast incremental detokenization.
 safetensors >= 0.6.2  # MXFP4/MXFP6 dtype support (F8_E8M0, F4) added in 0.6.0: https://github.com/huggingface/safetensors/pull/611
-protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.* # Required by LlamaTokenizer, gRPC. CVE-2026-0994
+protobuf != 6.30.0.dev, != 6.31.0.dev, != 6.32.0.dev, != 6.33.0.0.dev, != 6.33.1.0.dev, != 6.33.2.0.dev, != 6.33.3.0.dev, != 6.33.4.0.dev, >= 7.35.1 # Required by LlamaTokenizer, gRPC. CVE-2026-0994
 fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides.
 starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1
 aiohttp >= 3.13.3

requirements/test/cuda.txt

@@ -811,7 +811,7 @@ propcache==0.2.0
     #   yarl
 proto-plus==1.26.1
     # via google-api-core
-protobuf==6.33.6
+protobuf==7.35.1
     # via
     #   -c requirements/common.txt
     #   -r requirements/test/../common.txt