Security: operator Docker image uses python:3.12 (full) shipping 133 CRITICAL CVEs

## Summary

The operator [`Dockerfile`](https://github.com/dask/dask-kubernetes/blob/main/dask_kubernetes/operator/deployment/Dockerfile) uses `python:3.12` (the full Debian image) as its base. This causes the published `ghcr.io/dask/dask-kubernetes-operator` image to ship a large set of Debian packages that have no relevance to a Kubernetes operator — most notably **ImageMagick** and its associated libraries.

When scanned with Trivy, the `2026.3.0` image reports **133 CRITICAL vulnerabilities**, the overwhelming majority of which come from these unnecessary packages.

Summary from AI:

## Root cause

`python:3.12` (full) installs a broad Debian package set that includes:

- `imagemagick`, `libmagickcore-*`, `libmagickwand-*` (~8 CVEs × ~15 package variants = ~120 CRITICAL CVEs)
- `libraw` (3 CRITICAL CVEs, no fix available)
- `libopenexr` (2 CRITICAL CVEs, no fix available)
- `libmariadb-dev`, `mariadb-common` (1 CRITICAL CVE)
- `libunbound` (2 CRITICAL CVEs, no fix available)
- `libgnutls` (2 CRITICAL CVEs, fixable)
- `openssl` (1 CRITICAL CVE, fixable)

None of these are needed by the operator. The operator's actual Python dependencies (`kopf`, `kr8s`, `kubernetes`, `kubernetes-asyncio`, `distributed`, `dask`, `pykube-ng`, `rich`) are all pure Python and install cleanly on `python:3.12-slim`.

## Proposed fix

Change both stages in `dask_kubernetes/operator/deployment/Dockerfile` from:

```dockerfile
FROM python:3.12 as builder
...
FROM python:3.12
```

to:

```dockerfile
FROM python:3.12-slim as builder
...
FROM python:3.12-slim
```

This single change would eliminate ~130 of the 133 CRITICAL CVEs from the published image.

## Verification

The operator has no native-extension dependencies that would require system libraries beyond what `python:3.12-slim` provides. The `pip install` of the wheel succeeds on slim without any additional `apt-get` installs.

## Impact

Any cluster running the dask-kubernetes operator will report a large number of CRITICAL security findings from automated scanners (Trivy, Grype, etc.), making it difficult to distinguish real operational risk from inherited base-image noise. The operator itself is not exposed to the attack surface of ImageMagick or libraw — but the CVE count creates compliance burden for users.