Bump pillow and soupsieve to patched versions (#233)

Refresh uv.lock to clear 15 Dependabot alerts. Both are
docs-build-only transitive dependencies (pillow via
mkdocs-material[imaging] -> cairosvg; soupsieve via
mkdocs-llmstxt -> markdownify -> beautifulsoup4), in the local
docs dependency-group and never installed by library consumers.

  pillow    12.2.0 -> 12.3.0
  soupsieve 2.8.3  -> 2.9.1

Transitive-only: no pyproject.toml constraint change needed.

Author: chris-colinsky