deps(security): align lock files with pillow >= 12.2.0 (GHSA-whj4-6x5x-4v2j) (#231)

Follow-up to da5b55a — that commit pinned pillow >= 12.2.0 in
constraints/security.txt and bumped sbom/combined-requirements.txt, but
the three pip-tools lock files were not regenerated and still held
pillow==12.1.1. CI then failed at the Setup Python environment step
with:

    ERROR: Cannot install pillow==12.1.1 because these package versions
    have conflicting dependencies.
        The user requested pillow==12.1.1
        The user requested (constraint) pillow>=12.2.0

Every PR that hits that step was blocked (e.g. PR #230 python-multipart
bump:
  runs/24478599121/job/71537241656  python-quality
  runs/24478599121/job/71537241640  secrets-supply-chain).

Minimal fix: align the three lock files with the constraint floor
enforced by constraints/security.txt and already reflected in the SBOM.

Files touched:
  requirements.lock        pillow==12.1.1 → pillow==12.2.0
  requirements-dev.lock    pillow==12.1.1 → pillow==12.2.0
  requirements-scan.lock   pillow==12.1.1 → pillow==12.2.0

Not regenerating the lock files via pip-compile from scratch here so the
change stays surgical and auditable; a full lock refresh can be a
separate tidy-up PR.

Security context (GHSA-whj4-6x5x-4v2j — FITS GZIP decompression bomb in
Pillow, high severity, vulnerable range >= 10.3.0, < 12.2.0) is
unchanged from da5b55a.

Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net>

Author: neuron7xLab

requirements-dev.lock

@@ -395,7 +395,7 @@ pathspec==1.0.0
     # via
     #   black
     #   mypy
-pillow==12.1.1
+pillow==12.2.0
     # via
     #   captcha
     #   streamlit

requirements-scan.lock

@@ -75,7 +75,7 @@ optuna==3.6.2
 packaging==25.0
 pandas==2.3.3
 pandera==0.26.1
-pillow==12.1.1
+pillow==12.2.0
 prometheus-client==0.23.1
 propcache==0.4.1
 protobuf==6.33.5

requirements.lock

@@ -285,7 +285,7 @@ pandera==0.26.1
     # via
     #   -c constraints/security.txt
     #   geosync (pyproject.toml)
-pillow==12.1.1
+pillow==12.2.0
     # via
     #   captcha
     #   streamlit