Web and gateway dependencies patched to close all open advisories

The shipped web and gateway images are rebuilt to close every open dependency advisory.

On the web side, the bundled framework upgrade fixes cache poisoning of pre-rendered pages on self-hosted installs, the HTML sanitizer closes a DOM-based cross-site-scripting issue, and the image-processing and build-time libraries resolve several denial-of-service advisories.

On the gateway side, the model-routing library upgrade closes server-side request forgery through provider redirects, a template-injection flaw, and authentication-bypass issues; the web framework resolves request-URL spoofing and upload and Range denial-of-service; and an ASN.1 decoder denial-of-service is fixed.

No functional behavior changes; the images no longer carry the known-vulnerable versions.

Self-hosted operators must rebuild and recreate the web and gateway containers to pick up the fixes.