v1.107.6

### 🛡️ Security

A maintenance release for the v1 line, carrying the v1 backports of the four security fixes released in `2.44.0`. See each advisory for full details and affected versions.

- **[GHSA-vmxc-h2x2-jmf3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3)** (moderate): cloud-metadata and private-IP blocklist bypass via an IPv6 zone identifier, on a URL opted into local network access. Reported by @euriconicacio. (#8402)
- **[GHSA-fpf4-vwcp-v4hp](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp)** (moderate): superlinear response processing in `web_fetch`, in both the HTML conversion and the charset decode, blocking the event loop. Reported by @BrianWillows. (#8399, #8434)
- **[GHSA-22h6-qm39-v87j](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j)** (low): `web_fetch_tool` domain lists compared as written rather than in the form the resolver uses. (#8409)
- **[GHSA-4x9p-g9wm-8q7f](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f)** (low): OpenTelemetry spans carrying exceptions, error statuses, instructions and the output template under `include_content=False`. Reported by @BrianWillows. (#8404, #8422, #8429)

Also carried over: credentials are now dropped on a `safe_download` redirect whenever the full origin changes, not only the hostname (#8410). This was fixed on the v2 line some time ago and had never been backported.

Patched in `1.107.6`; all four are also patched on the v2 line in `2.44.0`.

## What's Changed

Every code change in this release is one of the security fixes above. Maintenance alongside them:

* Repair `v1` CI and its `mcp`, `anthropic`, and `duckduckgo` extras (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8406
* Pin FastA2A below 1 in the `a2a` extra (v1) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/8412

**Full Changelog**: https://github.com/pydantic/pydantic-ai/compare/v1.107.5...v1.107.6