deps(security): bump pdf-extract → 0.12.0 to pull lopdf 0.42.0

lopdf <0.42.0 has an unbounded-recursion stack overflow on deeply
nested PDF objects (advisory 2026-06-21). The vector through OxiCloud
is the search-index text extractor — anyone who can upload a file can
ship a malicious PDF, and the existing catch_unwind in
text_extractor::extract_pdf does not save us: a stack overflow aborts
the process, it is not a panic.

pdf-extract 0.12.0 requires lopdf ^0.42 which adds the depth bound;
the only consumer call (`extract_text_from_mem`) is API-compatible,
no source changes needed.

Cargo.toml

@@ -87,7 +87,7 @@ accept-language = "3.1.0"
 askama = "0.16.0"
 tantivy = "0.26.1"
 zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
-pdf-extract = "0.10.0"
+pdf-extract = "0.12.0"
 nom-exif = "3.6.1"
 extism = { version = "1.30.0", optional = true }
 toml = { version = "1.1.2", optional = true }