fix(stt): upgrade the base image's pip and setuptools before installing

python:3.11-slim ships CPython 3.11's frozen pip 24.0 and setuptools
79.0.1. OSV lists six pip advisories (CVE-2025-8869, CVE-2026-1703,
CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-13346; fixed by
26.2) and two setuptools ones (CVE-2026-59890, GHSA-xmj3-9gf7-h52w;
fixed by 84.1.0). Upgrading them first also means the app installs run
under a patched pip.

After the change the image resolves pip 26.2.2 and setuptools 84.2.1,
and an OSV batch query over all 41 installed packages comes back clean
(fastapi 0.162.0, starlette 1.10.0, python-multipart 0.0.33,
uvicorn 0.54.0, faster-whisper 1.2.1, ...). Trivy finds no fixable
Debian 13.7 OS vulnerabilities in the current python:3.11-slim, so no
apt upgrade layer is added. Smoke-tested: /health 200 and /transcribe
200 on a generated WAV.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stt-container/Dockerfile

@@ -1,6 +1,14 @@
 FROM python:3.11-slim
 
-RUN pip install --no-cache-dir \
+# The python:3.11 images freeze the pip and setuptools that shipped with that
+# CPython branch (pip 24.0, setuptools 79), and both have since collected
+# advisories: pip path traversal / tar-symlink / index-URL handling
+# (CVE-2025-8869, CVE-2026-1703, CVE-2026-3219, CVE-2026-6357, CVE-2026-8643,
+# CVE-2026-13346) and setuptools sdist/legacy-wheel path issues
+# (CVE-2026-59890, GHSA-xmj3-9gf7-h52w). Upgrade them first, so the installs
+# below also run under a patched pip.
+RUN pip install --no-cache-dir --upgrade "pip>=26.2" "setuptools>=84.1" \
+    && pip install --no-cache-dir \
     faster-whisper \
     fastapi \
     uvicorn[standard] \