Mandate Pillow>=10.0.1 because of libwebp CVE

[MatMaul]

Pull Request Checklist

• [x] Pull request is based on the develop branch
• [x] Pull request includes a changelog file.
• [x] Pull request includes a sign off
• [x] Code style is correct (run the linters)

[DMRobertson]

This ensures that people installing from PyPI directly will pull in a fixed version of libwebp that comes bundled in Pillow.

See

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863 for the CVE
• https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html for the pillow release
• https://github.com/matrix-org/synapse/issues/13315 for discussion of whether it's a good idea to support installing from PyPI directly.