[Fix] Fix security issue in django via minor version upgrade from 5.2.4 to 5.2.13

[aikido-autofix]

Upgrade Django to fix critical SQL injection vulnerabilities in QuerySet methods and FilteredRelation that could allow arbitrary SQL execution.

⚠️ Breaking changes analysis not available for: django

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-64459	🚨 CRITICAL	[django] SQL injection vulnerability in QuerySet filter/exclude/get methods and Q class when using dictionary expansion with a crafted _connector argument, allowing arbitrary SQL execution.
CVE-2025-57833	HIGH	[django] An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().
CVE-2026-1207	HIGH	[django] Raster lookups on RasterField allow SQL injection through the band index parameter, enabling remote attackers to execute arbitrary SQL queries on PostGIS databases.
AIKIDO-2025-10624	HIGH	[django] SQL injection vulnerability in FilteredRelation class when handling specially crafted dictionaries in QuerySet.annotate or QuerySet.alias, allowing arbitrary SQL command execution through malicious input.
CVE-2026-1312	MEDIUM	[django] QuerySet.order_by() is vulnerable to SQL injection through column aliases containing periods when used with FilteredRelation and dictionary expansion. This allows attackers to execute arbitrary SQL commands.
CVE-2025-13372	MEDIUM	[django] FilteredRelation is vulnerable to SQL injection through column aliases when using dictionary expansion with QuerySet.annotate() or QuerySet.alias() on PostgreSQL. An attacker can exploit this by crafting malicious dictionaries passed as **kwargs to execute arbitrary SQL commands.
CVE-2025-64458	LOW	[django] NFKC normalization in Python is slow on Windows, making redirect functions vulnerable to denial-of-service attacks through inputs with large numbers of Unicode characters. This affects HttpResponseRedirect, HttpResponsePermanentRedirect, and the redirect shortcut.
CVE-2026-33033	LOW	[django] MultiPartParser allows remote attackers to cause denial of service by submitting multipart uploads with base64 Content-Transfer-Encoding containing excessive whitespace, degrading performance through resource exhaustion.
CVE-2025-64460	LOW	[django] Algorithmic complexity in XML deserializer's getInnerText() function allows remote attackers to cause denial-of-service through CPU and memory exhaustion via specially crafted XML input.