Bump sw-utils v0.13.2 and fix CI security scans

[evgeny-stakewise]

Summary

• Bump sw-utils to v0.13.2 (pulls milagro_bls_binding v1.9.1 from git) and fix the resulting bls.Sign return type to BLSSignature.
• Exclude git-sourced deps from the pip-audit requirements export — pip-audit only checks PyPI and skips them anyway, and keeping them caused resolution conflicts (milagro pinned by commit here vs. by tag in sw-utils' metadata).
• Ignore the pyo3 GHSA-36hh-v3qg-5jq4 false positive in the Trivy scan via a committed .trivyignore (0.16.6 predates the vulnerable code; the advisory range has no lower bound). Added the checkout step and trivyignores input so the file reaches the scanner.

Test plan

• poetry run pre-commit run --all-files passes (black, isort, mypy, pylint, flake8, bandit, vulture, poetry lock check).