chore(deps): bump pillow to >=12.3.0

[kyamagu]

Summary

Bumps pillow floor from >=12.1.1 to >=12.3.0 and updates the lock (12.2.0 → 12.3.0).

This resolves 13 open Dependabot alerts (10 high, 3 medium), all affecting Pillow < 12.3.0:

Sev	Issue
high	Heap OOB write in ImageCmsTransform.apply() (output mode mismatch)
high	JPEG2000 tiled decode growing scratch buffer → DoS
high	Decompression-bomb DoS via PdfParser.PdfStream.decode()
high	Heap OOB write in Image.paste()/crop() (signed coord overflow)
high	Heap OOB write in RankFilter (integer overflow in ImagingExpand)
high	GdImageFile._open() skips decompression-bomb check
high	BdfFontFile bomb-protection bypass via font loading
high	FontFile.compile() skips decompression-bomb check
high	PcfFontFile._load_bitmaps() bomb-protection bypass
high	OOB read via attacker-controlled row stride on mmap path (McIdas AREA)
med	EPS negative %%BeginBinary byte count → infinite-loop DoS
med	TGA RLE encoder leaks ~57 KB adjacent heap into output
med	WindowsViewer.get_command() OS command injection via unescaped path

Test plan

• uv run pytest — 935 passed, 29 skipped
• uv run ruff check src/ tests/
• uv run mypy src/ tests/

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the project’s Pillow dependency floor to a patched release to address Dependabot-reported vulnerabilities, and regenerates the uv lockfile to reflect the new minimum version (plus lockfile marker normalization).

Changes:

• Bump runtime dependency requirement from pillow>=12.1.1 to pillow>=12.3.0.
• Update uv.lock to lock Pillow 12.3.0 and refresh associated lock metadata/markers.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Raises the minimum required Pillow version to >=12.3.0.
uv.lock	Locks Pillow 12.3.0 and includes additional lockfile rewrites (notably marker normalization across multiple packages).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.