Bug Report: Py library is insecure and needs patching

[lmbr-pip]

Describe the bug
Py versions <= 1.11.0

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.

CVSS score of 5.3 puts this as major.

Assets required
None

Steps to reproduce
Steps to reproduce the behavior:

1. Go to 'requirements.txt': https://github.com/o3de/o3de/blob/development/python/requirements.txt#L222
2. Look at the version of Py in use
3. Look at CVE for PY: https://cwe.mitre.org/data/definitions/1333.html

Expected behavior
PY is patched once a new version is available

Actual behavior
Py is insecure. No patched version exists

Screenshots/Video
If applicable, add screenshots and/or a video to help explain your problem.

Found in Branch
Dev

Desktop/Device (please complete the following information):

• Device: [e.g. PC, Mac, iPhone, Samsung]
• OS: [e.g. Windows, macOS, iOS, Android]
• Version [e.g. 10, Monterey, Oreo]
• CPU [e.g. Intel I9-9900k , Ryzen 5900x, ]
• GPU [AMD 6800 XT, NVidia RTX 3090]
• Memory [e.g. 16GB]

Additional context
Add any other context about the problem here.

[lmbr-pip]

Assigning to SIG/security to identify owners of Py and confirm issue details.

[dshmz]

SIG-Build checked this issue and Py module is not owned by SIG-Build, we need to figure out which SIG owns it. It should go to the overall triage to get the assignment to correct SIG.

[lmbr-pip]

SIG/testing touched this last (see #7155). Routing to SIG/testing for input.

[Kadino]

I'll look into why this is required. Preferably the package can be removed, as no secure version exists

[Kadino]

The only direct dependency is pytest, which is a fairly critical dependency:

python -m pipdeptree -r -p py
py==1.11.0
  - pytest==6.2.5 [requires: py>=1.8.2]

Confirmed owned by @o3de/sig-testing

[Kadino]

This is not a requirement of the latest versions of pytest, as of 20 days ago: pytest-dev/pytest@19dda7c

Can be resolved via updating pytest, its dependencies, and dependents: #10588