Bump pillow version to 10.3.0

[Mestrace]

Addresses security vulnerabilities:

• CVE-2024-28219: Pillow buffer overflow vulnerability fixed on Pillow == 10.3.0
• CVE-2023-50447: Arbitrary Code Execution in Pillow fix on Pillow == 10.2.0

[phibos]

Thanks for your time and your contribution. I fully understand that no one should run a system with vulnerable software. But should a library tell a user which version is the right one to use? Don't get me wrong but for example a user uses the system libraries lets say on Ubuntu 23.10. The pillow version shipped is 10.0.0-1ubuntu0.1 and CVE-2023-50447 has been fixed on 25 January 2024 (Source: https://changelogs.ubuntu.com/changelogs/pool/main/p/pillow/pillow_10.0.0-1ubuntu0.1/changelog).

If we specify a version range a user would be able to upgrade to the latest upstream version in an venv but could still use the system libraries if required.

pillow >= 10.0.1, < 11.0.0

We only have to modify the supported version range if there are breaking changes.

What do you think?