Bump security floor constraints for 4 transitive dependencies

protobuf >=5.29.6 (JSON recursion depth bypass — was stuck on 4.x from mediapipe era)
pillow >=12.1.1 (out-of-bounds write on PSD images)
tornado >=6.5.5 (multipart DoS + cookie validation — dev-only via ipykernel)

Resolves dependabot alerts #46, #47, #48, #49.
Alert #50 (onnx <=1.20.1) has no upstream fix yet and is dev-only.

Author: mprib

pyproject.toml

@@ -20,6 +20,8 @@ dependencies = [
     # Security floor constraints for transitive dependencies (dependabot alerts)
     "urllib3>=2.6.3",    # CVE fixes: decompression bomb, streaming API
     "fonttools>=4.60.2", # CVE fix: arbitrary file write, XML injection
+    "protobuf>=5.29.6",  # CVE fix: JSON recursion depth bypass
+    "pillow>=12.1.1",    # CVE fix: out-of-bounds write loading PSD images
 ]
 
 [project.urls]
@@ -136,4 +138,5 @@ dev = [
     # Security floor constraints for transitive dependencies (dependabot alerts)
     "filelock>=3.20.3",   # CVE fix: TOCTOU symlink vulnerability
     "virtualenv>=20.36.1", # CVE fix: TOCTOU directory creation
+    "tornado>=6.5.5",     # CVE fixes: multipart DoS, cookie validation
 ]