Remove evaluation-dependent code, address a CVE

[ssiegel95]

• remove from main evaluation-dependent code used in a single demo context
• lower bound on urllib3 to address https://www.mend.io/vulnerability-database/CVE-2024-37891

[ssiegel95]

I guess since we have tsfmhfdemos in our package list we need to find a better solution than just removing that directory. I'll revert that commit.

packages = [
    "tsfm_public",
    "tsfm_public.toolkit",
    "tsfm_public.models",
    "tsfm_public.models.tinytimemixer",
    "tsfm_public.models.tinytimemixer.utils",
    "tsfmhfdemos",
    "tsfmhfdemos.neurips",
    "tsfmhfdemos.neurips.backends",
    "tsfmhfdemos.neurips.backends.v1",
    "tsfmhfdemos.neurips.backends.v1.figures",
]

[wgifford]

Hi Stuart -- a few weeks ago we addressed the CVE by requiring >= 1.26.19. (CVE can be addressed by either version 1.26.19 or version 2.2.2.) I think there was another dependency that required < 2 -- possibly this is changed now with a later version of transformers and/or datasets?

[ssiegel95]

Okay, I'll make that change.