[Security] Remove mandatory ai-cloudscraper dependency

[SakenW]

Summary

• restore the standard cloudscraper>=1.2.71 dependency used by synchronous translation
• remove the mandatory ai-cloudscraper -> js2py dependency chain
• move aiohttp behind a new translators[async] extra and lazy-load async APIs
• make async Reverso use the existing aiohttp/httpx session layer instead of create_async_scraper()
• preserve the existing async compatibility attributes and validate session/client pairing
• add deterministic regression tests for import isolation, proxy handling, and cached client switches

Why

translators==6.0.4 currently requires ai-cloudscraper>=3.7.6, which requires js2py>=0.74. Js2Py 0.74 is affected by CVE-2024-28397 / GHSA-h95x-26f3-88hr.

This change removes that vulnerable transitive dependency from both the normal and async installation graphs. It does not claim that a remotely exploitable path was proven in translators; it removes a publicly documented vulnerable package that is currently mandatory for every 6.0.4 installation.

Fixes #192.

Compatibility

• synchronous users continue to install and call translators normally
• asynchronous users install translators[async]
• translate_text_with_async, translate_html_with_async, preaccelerate_and_speedtest_with_async, and close_with_async remain available as coroutine functions
• Reverso keeps its aiohttp default and also supports httpx
• a supplied or cached session determines the response adapter; conflicting client switches fail explicitly instead of reusing the wrong session type
• aiohttp versions without constructor-level proxy support are directed to the existing httpx path

The package version remains unchanged in this source PR. A merged release should be published as a new version such as 6.0.5; the existing PyPI 6.0.4 artifact must not be overwritten.

Validation

• built wheel and sdist successfully; twine check passed for both
• inspected wheel metadata: base dependencies contain cloudscraper, do not contain ai-cloudscraper, Js2Py, or aiohttp, and expose aiohttp only through extra == "async"
• clean Python 3.13 sync-only wheel install: import isolation and sync routing passed, pip check passed, and pip-audit reported no known vulnerabilities
• six deterministic tests passed with aiohttp 3.14.1 and aiohttp 3.10.11
• live async Reverso smoke tests passed through both aiohttp and httpx (hello -> bonjour)
• focused Ruff fatal-error checks and git diff --check passed

The repository still emits its pre-existing invalid-regex-escape SyntaxWarning; this patch does not introduce or modify that warning.