fix(ci): async client violation in a2a + Python 3.13 CVE allowlist

- Replace direct httpx.AsyncClient usage in a2a_protocol/main.py with
  get_async_httpx_client to avoid +500ms latency per request
- Add CVE-2026-2297 (Python 3.13 import hook) to security allowlist,
  no fix available yet

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ci_cd/security_scans.sh

@@ -162,6 +162,7 @@ run_grype_scans() {
         "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
         "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
         "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal via drive-relative linkpath - transitive dep, not directly exploitable in this context
+        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader import hook issue - no fix available yet
     )
 
     # Build JSON array of allowlisted CVE IDs for jq

litellm/a2a_protocol/main.py

@@ -664,15 +664,21 @@ async def create_a2a_client(
 
     verbose_logger.info(f"Creating A2A client for {base_url}")
 
-    # Always create a fresh httpx client per A2A call so that per-agent auth
-    # headers (extra_headers) are never shared across agents or requests.
-    # Mutating a cached shared client would cause headers from one agent to
-    # bleed into requests made to a different agent.
-    httpx_client = httpx.AsyncClient(
-        timeout=httpx.Timeout(timeout),
-        headers=extra_headers or {},
-    )
+    # Use LiteLLM's cached httpx client to avoid creating a new client per
+    # request (+500ms latency).  When extra_headers are provided they are
+    # included in the cache-key params so that per-agent auth headers are
+    # never shared across agents.
+    _params: Dict[str, Any] = {"timeout": timeout}
     if extra_headers:
+        # Sort keys for deterministic cache key generation
+        _params["extra_headers"] = str(sorted(extra_headers.items()))
+    http_handler = get_async_httpx_client(
+        llm_provider=httpxSpecialProvider.A2A,
+        params=_params,
+    )
+    httpx_client = http_handler.client
+    if extra_headers:
+        httpx_client.headers.update(extra_headers)
         verbose_proxy_logger.debug(
             f"A2A client created with extra_headers={list(extra_headers.keys())}"
         )