bump oa-configurator to 1.2.1

[gkennos]

Pins oa-configurator>=1.2.1 and refreshes the lock.

1.2.1 carries the safe_endpoint fragment fix (oa-configurator #32). Before it, a
URL fragment was passed through verbatim, so a ProviderConfig.base_url of

https://host/v1?api-version=2024-02-01#access_token=sk-x

rendered in the inspection tree with the token intact — the query string was
masked, the fragment was not. The OAuth implicit flow delivers access tokens in
exactly that position. 1.2.1 masks a non-empty fragment whole, to #***.

This matters here because snapshot() routes ProviderConfig.base_url through
safe_endpoint, so groundskeeping inherited the gap directly. >=1.2 would
have resolved to 1.2.0 and kept it.

No test is added in this PR. The behaviour is covered upstream in
oa-configurator's own suite, and the rendering path that consumes it is already
covered by test_provider_base_url_is_masked_through_safe_endpoint.

Dependency and lock only — no source changes.

🤖 Generated with Claude Code