fix(deps): bump pillow 12.2.0->12.3.0, floor click>=8.3.3 to clear pip-audit CVEs (#408)

Pillow 12.2.0 carries PYSEC-2026-2253/54/55/56/57; click 8.3.2 (transitive
via transformers -> typer) carries PYSEC-2026-2132. Bumps the direct Pillow
pin and adds a [tool.uv] constraint floor for the transitive click. Relock
moves only click 8.3.2->8.4.2 and pillow 12.2.0->12.3.0.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: arekay-nv

pyproject.toml

@@ -19,6 +19,9 @@ conflicts = [
     [{ extra = "bfcl" }, { extra = "test" }],
     [{ extra = "bfcl" }, { extra = "performance" }],
 ]
+# CVE floors for transitive deps we don't declare directly. click is pulled in
+# via transformers -> typer; 8.3.2 carries PYSEC-2026-2132 (fixed in 8.3.3).
+constraint-dependencies = ["click>=8.3.3"]
 
 [tool.uv.build-backend]
 module-root = "src"
@@ -77,7 +80,7 @@ dependencies = [
     "jinja2==3.1.6",
     "numpy>=1.26.4",
     "datasets==4.8.4",
-    "Pillow==12.2.0",
+    "Pillow==12.3.0",
     "sentencepiece==0.2.1",
     "protobuf==7.34.1",
     "openai_harmony==0.0.8",