Restore Python 3.6 compatibility

Remove Python 3.7+ constructs so the tool runs on 3.6:

- Drop `from __future__ import annotations` (3.7+) and convert all
  builtin-generic annotations (list[]/dict[]/tuple[]/set[]) to their
  typing.List/Dict/Tuple/Set equivalents, since without the future
  import these annotations are evaluated eagerly and builtin generic
  subscription only exists on 3.9+.
- Replace subprocess.run(capture_output=, text=) — both 3.7+ — with
  stdout/stderr=PIPE and universal_newlines=True; update the matching
  test assertion.
- requirements.txt: gate cryptography>=41 behind python_version>=3.7 and
  pin cryptography<41 (last 3.6-compatible line, 40.0.2) plus the
  dataclasses backport for 3.6.
- Suppress cryptography 40.x's per-import "Python 3.6 is no longer
  supported" deprecation warning so it doesn't pollute CLI/cron stderr;
  the <41 pin keeps us on a supported release regardless.

The only cryptography API used is AESGCM (present since 2.0), so no
x509/API-surface changes are needed for the older pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_easyrsa.py

@@ -1,3 +1,5 @@
+import subprocess
+
 import pytest
 from unittest.mock import patch, MagicMock
 from openvpncertupdate import (
@@ -82,7 +84,9 @@ def test_copy_crl_skips_restorecon_when_binary_empty(mock_chmod, mock_copy, mock
 def test_copy_crl_runs_restorecon_when_binary_set(mock_chmod, mock_copy, mock_run):
     copy_crl("/pki", "/etc/openvpn/crl.pem", restorecon_binary="restorecon")
     mock_run.assert_called_once_with(
-        ["restorecon", "/etc/openvpn/crl.pem"], capture_output=True, text=True)
+        ["restorecon", "/etc/openvpn/crl.pem"],
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        universal_newlines=True)
 
 
 @patch("openvpncertupdate.subprocess.run", side_effect=FileNotFoundError("no restorecon"))