fix(deps): resolve 26.08 rc9 container CVEs (#3607)

* fix(deps): resolve 26.08 rc9 container CVEs

Address the 26.08.rc9 nSpect container scan:

- pyasn1>=0.6.4 for GHSA-hm4w-wwcw-mr6r (uncontrolled resource consumption
  decoding REAL values) and GHSA-8ppf-4f7h-5ppj (quadratic OBJECT IDENTIFIER
  parsing).
- soupsieve>=2.8.4 for GHSA-836r-79rf-4m37 (selector-parser ReDoS) and
  GHSA-2wc2-fm75-p42x (memory exhaustion on large selector lists); soupsieve
  reaches the venv through beautifulsoup4 and resolves to 2.9.2.
- Drop ray/jars from the venv for GHSA-r7wm-3cxj-wff9 in the jackson-core
  vendored by ray_dist.jar. Ray still ships jackson 2.18.6 as of 2.57.0, so no
  version bump clears it; Ray is a transitive Python-only dependency here and
  Automodel never launches Java workers, so the jars are unused. This also
  removes the earlier jackson-databind findings from the same jar.

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(docker): condense ray jar removal comment

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>