fix #115: upgrade pillow in zotero image (CVE-2026-25990)

Remaining zotero vulns are Go stdlib and firefox in the
selkies-project/nvidia-egl-desktop base image — unfixable
from our Dockerfile until upstream updates.

zotero/Dockerfile

@@ -12,6 +12,9 @@ RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-reco
         zotero \
     && rm -rf /var/lib/apt/lists/*
 
+# Patch Python packages with known CVEs from base image
+RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"
+
 # Create desktop shortcut for Zotero
 RUN mkdir -p /home/ubuntu/Desktop \
     && cp /usr/share/applications/zotero.desktop /home/ubuntu/Desktop/ \