Update NLTK to 3.9.1 to address security vulnerability

Resolves nltk/nltk#3266 - remote code execution
vulnerability in NLTK versions < 3.9.1. This addresses a high-severity
dependabot alert by explicitly pinning NLTK to ^3.9.1 in both
estuary-cdk and source-qualtrics dependencies.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: skord