FIX address dependabot alerts by bumping package versions

[romanlutz]

Fix 11 Dependabot security alerts

Bump vulnerable dependencies to patched versions.

Python (pyproject.toml + uv.lock):

• pypdf ≥6.8.0 — fixes RAM exhaustion via manipulated stream lengths (Cleanup notebook outputs #56)
• gradio ≥6.7.0 — fixes SSRF, open redirect, path traversal, and OAuth credential exposure (Refactoring Docs to use JupyText #49–52)
• orjson ≥3.11.6 constraint — fixes unlimited recursion for nested JSON (Add Details to Contributor Guide About Forking/PRs #59)
• tornado ≥6.5.5 constraint — fixes DoS via multipart parts and cookie validation (Add release instructions #57–58)

npm (frontend/):

• minimatch — fixes ReDoS via npm audit fix (Standardizing environment for completions and embeddings #46–47)
• @tootallnate/once ≥3.0.1 — fixes incorrect control flow scoping via npm override (Add learn link to README #55)

Not addressed:

• diskcache (Update Demo Notebook Prerequisites #30) — no patched version available