CTM-323 Upgrade libraries, pin to Python 3.12

[aednichols]

• Upgrade urllib3, requests to latest versions to address vulns
• Upgrade CI to Python 3.12 as Poetry dropped 3.9 support [0]
• Pin Poetry version to current
• Floating Python version in Dockerfile was giving us 3.14 in production [1], address by pinning to 3.12
  • CI and production should obviously use the same version
• Remove temp workaround with Debian testing, no longer necessary [2]

Why 3.12? It's the latest version for which we have a pinned base image.

Similar to Job Manager DataBiosphere/job-manager#803

[0] https://github.com/python-poetry/poetry/releases/tag/2.3.0
[1]

# Current production
> docker run -it --entrypoint /bin/bash gcr.io/broad-dsp-gcr-public/calhoun:dev -c "python --version"
Python 3.14.0

[2]

# This branch
> docker run -it --entrypoint /bin/bash gcr.io/broad-dsp-gcr-public/calhoun@sha256:c1a4e930f98db00eeda947b3013dfc55792069828c0d766e3ed64965dbcae74f -c "R --version"
R version 4.5.0 (2025-04-11) -- "How About a Twenty-Six"
Copyright (C) 2025 The R Foundation for Statistical Computing
Platform: x86_64-pc-linux-gnu

[lucymcnatt]

thanks for the cleanup!