deps: bump nltk to 3.10.3 (clears reported advisories)

[katsugtgz]

Updates nltk to 3.10.3 to clear the advisories reported against the pinned 3.9.2, including GHSA-m4rf-3fr8-xwx3 (JVM argument injection in the Stanford wrappers, critical) and GHSA-6hwm-xvph-95vm (uncontrolled search path when invoking the Graphviz dot binary).

Evidence:

• requirements.txt pinned nltk==3.9.2
• the OSV database reports 48 advisories against nltk@3.9.2
• updated version: 3.10.3

Validation:

• the OSV database reports no advisories for nltk@3.10.3
• pip install --dry-run nltk==3.10.3 resolves cleanly, pulling defusedxml as the one new dependency
• the usage in this repo (from nltk.translate.bleu_score import sentence_bleu, SmoothingFunction in src/r1-v/src/open_r1/oss_grpo_4subtol.py and the other training scripts) was smoke tested on 3.10.3: import and a sentence_bleu call both work
• the repo has no test suite or CI workflow, so no documented test command exists to run

Scope: requirements.txt only.