fix: add BSP registry to requirements.txt

[Eraz1997]

Add BSP Python registry proxy index URL to requirements.txt to resolve supply-chain security findings.

🤖 Generated with OpenCode (Gemini)

[komoot-guardian]

🤖 Security Review Dashboard

Status: 1 open issue · Scanned commit 26d35c6

ℹ️ First-commit-only mode: Subsequent commits on this branch will not be automatically re-reviewed. Comment @komoot-guardian review to request a manual re-review on the latest commit.

#	Issue	Status	Link
1	Credential-bearing pip index URL in public repo	Open	thread

Comment with @komoot-guardian review to re-run on new commits.
Reply won't fix / intended in a thread to dismiss (reflected here after the next review).

[komoot-guardian]

🤖 Security findings on 26d35c6 — tracked in Security Review Dashboard.

[komoot-guardian]

🤖 Security Issue [sha=26d35c6]: Credential-bearing pip index URL in public repo

A pip index URL embedding $ARTIFACTORY_USERNAME/$ARTIFACTORY_ACCESS_TOKEN is added to a tracked file in the public komoot/staticmap repository, inviting anyone troubleshooting the build to substitute real Artifactory credentials that would then be published in Git history. See 26d35c6:requirements.txt:L1. Sibling BSP repos set this via CI-provided PIP_INDEX_URL, but this repo has no workflows, so the line only becomes functional by pasting real secrets locally.

Fix: Point this public repo at a credential-free index (or export PIP_INDEX_URL from a CI secret store) instead of embedding credential placeholders in requirements.txt.

Severity: medium

[Eraz1997]

Closed: repository is public and should not point to internal Artifactory.