Pillow < 9.0.0 security vulnerabilities

[areusch]

Thanks! filed https://github.com/apache/tvm/issues/10238, i think this is not a formal requirement for TVM but just a loose end which was not updated.