cves: replace pip's vendored msgpack 1.1.2 with >=1.2.1 to fix GHSA-6v7p-g79w-8964

[tetrate-ci]

Summary

pip 26.x ships msgpack 1.1.2 in its internal _vendor directory (used for pip's own cache operations). A regular pip install msgpack>=1.2.1 installs a newer user-facing copy but does not touch pip's vendor directory, so vulnerability scanners (trivy, JFrog Xray) still detect the old 1.1.2 in the base image layer.

This PR adds a Dockerfile step that:

1. Installs msgpack>=1.2.1 to a temporary location
2. Copies the Python source files into pip's _vendor/msgpack/
3. Clears the stale bytecode cache
4. Updates pip's CycloneDX SBOM (bom.cdx.json) to reflect the patched version

CVEs Fixed

CVE ID	Severity	Package	Fixed Version
GHSA-6v7p-g79w-8964	HIGH	msgpack (pip vendor)	1.2.1+

Verification

Build and scan:

docker build -t test-r3 .
trivy image --pkg-types library test-r3 2>/dev/null | grep msgpack
# Only msgpack 1.2.2 should appear, no 1.1.2

cc @kezhenxu94