deps: bump nltk to 3.10.3 in vLLM env pins

[katsugtgz]

Updates nltk in both vLLM environment pin files to clear the reported advisories.

Evidence:

• envs/vllm/0.15.1/requirements.txt and envs/vllm/0.12.0/requirements.txt pinned nltk==3.9.4
• osv-scanner reported 62 advisories for nltk@3.9.4 (including GHSA-x99w-6fgc-pmfw, GHSA-rhp5-r9x4-f5g2, PYSEC-2026-3736) before the update
• updated version: 3.10.3

Validation:

• osv-scanner --lockfile envs/vllm/0.15.1/requirements.txt and --lockfile envs/vllm/0.12.0/requirements.txt no longer report those 62 advisories after the update
• python -c "import nltk" passes with nltk==3.10.3 on Python 3.12
• the documented uv run pytest tests/ -v could not complete here: the editable install resolves a large CUDA/torch dependency set that does not finish in this environment. The two env files are reference pins for prebuilt vLLM images and nltk is not imported by the package code or its tests.

Note: osv-scanner still reports one advisory for nltk@3.10.3: GHSA-8mgp-746c-j5xp. No fixed release exists yet (3.10.3 is the latest nltk release), so this patch takes the package to the newest available version.

Scope: the two envs/vllm/*/requirements.txt files only.