Fix critical nltk Zip Slip vulnerability (CVE in dependabot #48)

Add uv override to require nltk>=3.9.3, which patches the Zip Slip
vulnerability that allows arbitrary code execution via malicious
zip packages in NLTK's downloader component.

The vulnerable nltk 3.9.2 was pulled in as a transitive dependency
via the safety package.

Author: woutervh

pyproject.toml

@@ -258,6 +258,10 @@ managed = true
 package = true
 default-groups = "all"
 
+# Fix critical Zip Slip vulnerability in nltk < 3.9.3 (transitive dep via safety)
+# https://github.com/libranet/autoread-dotenv/security/dependabot/48
+override-dependencies = ["nltk>=3.9.3"]
+
 [[tool.uv.index]]
 name = "testpypi"
 url = "https://test.pypi.org/simple/"