BUILD: Bump Cython to 3.1
- [x] closes #60972 (Replace xxxx with the GitHub issue number)
- [ ] [Tests added and passed](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#writing-tests) if fixing a bug or adding a new feature
- [ ] All [code checks passed](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#pre-commit).
- [ ] Added [type annotations](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#type-hints) to new arguments/methods/functions.
- [ ] Added an entry in the latest `doc/source/whatsnew/vX.X.X.rst` file if fixing a bug or adding a new feature.

ASVs: https://github.com/pandas-dev/pandas/issues/60972#issuecomment-2906286143
> Could you also bump cython in the ci/deps files?

Bumped. The pin there was `cython>=0.29.33` (except freethreading which doesn't have any pin), but I do think having some upper bound is preferable. 

From the 2 to 3 transition, I was cautious about accepting new versions and I think now overly so. What do you think about `cython<4` instead? > From the 2 to 3 transition, I was cautious about accepting new versions and I think now overly so. What do you think about cython<4 instead?

Yeah I would be OK with that (modulo pinning below alpha/rc release versions since Cython often to pre-releases before major version bumps) Owee, I'm MrMeeseeks, Look at me.

There seem to be a conflict, please backport manually. Here are approximate instructions:

1. Checkout backport branch and update it.

```
git checkout 2.3.x
git pull
```

2. Cherry pick the first parent branch of the this PR on top of the older branch:
```
git cherry-pick -x -m1 5c286b7ef9f63487169bed5a8fb5d31c00b9b1c3
```

3. You will likely have some merge/cherry-pick conflict here, fix them and commit:

```
git commit -am 'Backport PR #61519: BUILD: Bump Cython to 3.1'
```

4. Push to a named branch:

```
git push YOURFORK 2.3.x:auto-backport-of-pr-61519-on-2.3.x
```

5. Create a PR against branch 2.3.x, I would have named this PR:

> "Backport PR #61519 on branch 2.3.x (BUILD: Bump Cython to 3.1)"

And apply the correct labels and milestones.

Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon!

Remember to remove the `Still Needs Manual Backport` label once the PR gets merged.

If these instructions are inaccurate, feel free to [suggest an improvement](https://github.com/MeeseeksBox/MeeseeksDev).
                 Thanks @rhshadrach  Why was the lower bound removed? I just tried building with cython 0.29.36 and the build failed. What is the correct lower bound? It seemed unnecessary, our CI will pull in 3.x regardless of the presence of a lower bound or not.

I would imagine you'll need at least 3.0. If you have a use case for pandas guaranteeing support for older versions of Cython, can you open an issue. I definitely don't care about supporting older cython, I'm just worried that not specifying a lower bound will lead to issues. My specific issue occurred with the Spack package manager, not with pip. Not all package managers will always use a newer version if an old version is already installed. Conda may or may not have similar issues, I don't know enough about its internals. Thanks; I can update this to include `>= 3.0`.