fix(deps): bump Werkzeug to 3.1.8 to fix intermittent multipart CRLF corruption (#17884)

## Summary
- Pin `werkzeug>=3.1.7,<4` and refresh `uv.lock` to **3.1.8**.
- Fixes intermittent corruption of uploaded file bodies: when TCP
segments split right after multipart part headers, Werkzeug **3.1.5**
can include a leading `\r\n` in the file content
([pallets/werkzeug#3088](https://github.com/pallets/werkzeug/issues/3088);
fixed in 3.1.7).
- In RAGFlow this commonly breaks `.xlsx` parsing: ZIP/OOXML magic
(`PK\x03\x04`) no longer matches, the Excel parser falls back to CSV,
then fails with UTF-8 decode errors such as `invalid start/continuation
byte`.

Made with [Cursor](https://cursor.com)

Co-authored-by: zhangjiangshan1 <zhangjiangshan1@kingsoft.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Jin Hai <haijin.chn@gmail.com>

pyproject.toml

@@ -100,6 +100,10 @@ dependencies = [
     "qianfan==0.4.6",
     "quart-auth==0.11.0",
     "quart-cors==0.8.0",
+    # Werkzeug 3.1.5 can prepend \r\n to multipart file bodies when TCP chunks
+    # split at part headers (https://github.com/pallets/werkzeug/issues/3088);
+    # fixed in >=3.1.7. Pin so uv.lock cannot resolve back to the buggy release.
+    "werkzeug>=3.1.7,<4",
     "ranx==0.3.20",
     "readability-lxml>=0.8.4,<1.0.0",
     "replicate==0.31.0",