BLD: update pillow dependency

[tacaswell]

Pillow has a security issue for <6.2.0 (CVE-2019-16865).

This is in violation of our normal support window for dependencies,
however we are making an exception due to the CVE.

This may be too aggressive of a pinning from our down-stream
packagers, but they can patch this out if required.

PR Summary

PR Checklist

• Has Pytest style unit tests
• Code is Flake 8 compliant
• New features are documented, with examples if plot related
• Documentation is sphinx and numpydoc compliant
• Added an entry to doc/users/next_whats_new/ if major new feature (follow instructions in README.rst there)
• Documented in doc/api/api_changes.rst if API changed in a backward-incompatible way

[tacaswell]

We only have a hard dependency on pillow on master branch.

[timhoffm]

Should we set up https://dependabot.com/ for the project? It would have warned and created this PR automatically.

[tacaswell]

github them selves warned us (or at least me?) about this one.

[timhoffm]

Ok, then at least you get the info already 😄.

[QuLogic]

TBH, I'm not really sure we need to do this regularly (having not looked at the CVE.) Patches could have been backported depending on where you get Pillow, so our requirement really should be about functionality.