[unticketed]: resolve anchore cve's - #12615

## Summary

PR #1014 fails Anchore on the sole remaining finding: `CVE-2026-87910`
in CPython 3.14.8 (`/usr/local/lib/libpython3.14.so.1.0`). Add a
documented temporary safelist entry, following the existing policy for
Python vulnerabilities whose fix is unavailable on the supported runtime
line. This suppresses the finding; it does **not** patch the
vulnerability.

The [3.14 backport](python/cpython#157307)
merged on October 1 after the 3.14.8 release. The [PSF CVE
record](https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/87xxx/CVE-2026-87910.json)
still marks the 3.14 series affected, and the [release
announcement](https://blog.python.org/2026/10/python-31022-31117/) lists
this fix for 3.10–3.13 only. Remove the exception once
`python:3.14-slim` contains the backport and Grype recognizes the fixed
release.


[HHS/simpler-grants-gov#12615](HHS/simpler-grants-gov#12615)
updates urllib3, Amazon Linux packages and frontend dependencies; none
addresses this CPython finding in the Debian-based NOFO image. No
dependency or image changes are needed for this temporary scan-policy
change.

After this PR merges, rebase #1014 onto main to pick up the exception.
The deployment repository maintains a separate `.grype.yml`; its NOFO
deployment scan will need the same exception while the runtime fix
remains unreleased. This PR changes only the PDF Builder repository.

## Test plan

- Reviewed the failed Anchore job on #1014; confirmed this is its only
reported match.
- Grype 0.119.0 successfully loaded `.grype.yml` and recognized the new
ignore entry.
- Pre-commit checks passed, including YAML validation; `git diff
--check` passed.
- Application tests are unchanged and were not run locally for this
scan-configuration-only change. GitHub CI will build and scan the actual
image; no local Docker runtime is available.

…2687)

## Summary

Work for #8109

## Changes proposed
- Bump PYTHON_VERSION in api/docker-python-base from 3.14.7 to 3.14.8.
- Point api/Dockerfile and analytics/Dockerfile at the rebuilt
python-base-image.
- Safelist CVE-2026-12345 (tempfile, no 3.14 fix yet). This was #12686,
folded in here because each change needs the other to pass the scans.

## Context for reviewers
• The api and analytics Anchore scans fail on python 3.14.7 /
CVE-2026-19672 / Medium, which is fixed in 3.14.8. This affects every PR
that runs those scans, including #12686.
• Same process as #12615: the base image was built from this branch with
the "Build Python Base Image" workflow, then pinned by tag and digest.

## Validation steps
	•	The api and analytics Anchore scans on this PR should pass.