bazel/thirdparty: bump aiohttp off a yanked release

We are using aiohttp 3.11.14 which was yanked from PyPI:
https://github.com/aio-libs/aiohttp/issues/10617

This causes a bunch of warnings in a clean build and also prevents
bazel from using its downloader (it falls back to pip).

Bump to 3.11.18, the next release in the same minor
that is not yanked.

The warnings are gone. This change only affects dev_cluster,
which uses aioboto3, which pulls in this dep.

Fixes CORE-17093