DEPS: update numexpr to use not buggy numexpr 2.8.x anymore (update to 2.9.0) - fix critical CVE-2023-39631⁠
update numexpr to 2.9.0 to fix CVE-2023-39631⁠ findings

HINT: come from other project (apache-superset) where panda is injecting this faulty numexpr inside the project as sub-dependency

- [ ] closes #xxxx (Replace xxxx with the GitHub issue number)
- [ ] [Tests added and passed](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#writing-tests) if fixing a bug or adding a new feature
- [ ] All [code checks passed](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#pre-commit).
- [ ] Added [type annotations](https://pandas.pydata.org/pandas-docs/dev/development/contributing_codebase.html#type-hints) to new arguments/methods/functions.
- [ ] Added an entry in the latest `doc/source/whatsnew/vX.X.X.rst` file if fixing a bug or adding a new feature.

Thanks for the PR, but pandas tries to support optional dependencies that are at most 1 year old. Additionally, pandas just species a lower pin, so a user is able to specify numexpr>=2.9.0 if they want to avoid this CVE. pandas will bump to 2.9.0 eventually, but I think it's too early to do so at this moment so closing