python3-oauthlib: Upgrade 4.0.0 -> 4.0.1

Upgrade to release 4.0.1:

- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
  endpoint did not validate the device_code parameter. A request
  with a known client_id and a bogus device_code could obtain a
  bearer token. DeviceCodeGrant.validate_token_request now calls
  DeviceCodeGrant.validate_device_code(), which rejects missing or
  unknown device codes (invalid_request / invalid_grant) and
  delegates the code's authorization status to the new
  RequestValidator.validate_device_code() hook, per RFC 8628
  Section 3.5.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb

@@ -0,0 +1,24 @@
+SUMMARY = "A generic, spec-compliant, thorough implementation of the OAuth request-signing logic"
+HOMEPAGE = "https://github.com/idan/oauthlib"
+
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=2699a9fb0d71d5eafd75d8d7c302f7df"
+
+SRC_URI[sha256sum] = "3d73febdb6faa00f277c81fb04be7b7586fb96fc3b7f0b9c772dada69a25ede7"
+
+CVE_PRODUCT = "oauthlib"
+
+inherit pypi setuptools3
+
+# The following configs & dependencies are from setuptools extras_require.
+# These dependencies are optional, hence can be controlled via PACKAGECONFIG.
+# The upstream names may not correspond exactly to bitbake package names.
+#
+# Uncomment this line to enable all the optional features.
+#PACKAGECONFIG ?= "test signedtoken signals rsa"
+PACKAGECONFIG[test] = ",,,python3-blinker python3-cryptography python3-pytest python3-pyjwt"
+PACKAGECONFIG[signedtoken] = ",,,python3-cryptography python3-pyjwt"
+PACKAGECONFIG[signals] = ",,,python3-blinker"
+PACKAGECONFIG[rsa] = ",,,python3-cryptography"
+
+RDEPENDS:${PN} += "python3-core python3-crypt python3-datetime python3-json python3-logging python3-math python3-netclient python3-unittest"