chore(deps): bump pillow, django, uv to patch security vulnerabilities (#213)

* chore(deps): bump pillow from 12.1.1 to 12.2.0 in /requirements

Fixes GHSA-whj4-6x5x-4v2j (CVE-2026-40192): FITS GZIP decompression bomb
in Pillow. Affected versions: >= 10.3.0, < 12.2.0.

* chore(deps): bump django to 6.0.4 and uv to 0.11.7

Fixes pip-audit findings blocking CI:
- django 6.0.3 -> 6.0.4: CVE-2026-33033, CVE-2026-33034, CVE-2026-4292,
  CVE-2026-4277, CVE-2026-3902
- uv 0.10.8 -> 0.11.7: GHSA-pjjw-68hj-v9mw

Author: matrixise

requirements/dev.txt

@@ -142,7 +142,7 @@ packaging==26.0
     #   pip-audit
     #   pip-requirements-parser
     #   pipdeptree
-pillow==12.1.1
+pillow==12.2.0
     # via
     #   -c main.txt
     #   pillow-heif
@@ -212,7 +212,7 @@ urllib3==2.6.3
     # via
     #   -c main.txt
     #   requests
-uv==0.11.6
+uv==0.11.7
     # via -r dev.in
 wagtail==7.2.3
     # via

requirements/main.txt

@@ -117,7 +117,7 @@ packaging==26.0
     # via gunicorn
 pandas==3.0.1
     # via -r main.in
-pillow==12.1.1
+pillow==12.2.0
     # via
     #   pillow-heif
     #   wagtail