chore(deps): Update docker.io/library/python Docker tag to v3.15.2

.gitea/workflows/renovate.yaml

@@ -151,7 +151,7 @@ jobs:
     # actions/checkout: Renovate clones the repo itself from RENOVATE_ENDPOINT, and as uid 12021
     # checkout could not `git init` the root-owned workspace volume anyway.
     container:
-      image: ghcr.io/renovatebot/renovate:44.237.3
+      image: ghcr.io/renovatebot/renovate:44.227.4
     # Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
     # well under a runner's patience. Without a timeout a wedged run holds the `renovate`
     # concurrency group and silently blocks every subsequent scheduled run.

platform/vuln-scanner/deployment.yaml

@@ -109,7 +109,7 @@ spec:
           # (19 days old; 3.14.10-alpine, the current 3.14-alpine, was built 2026-11-05 and is under
           # the 7-day age applied here by hand). Tracked by the `kubernetes` Renovate manager.
           # Runs as 65532 from this pod's securityContext; the image's default is root, overridden.
-          image: docker.io/library/python:3.14.9-alpine@sha256:dbeb11d16bb95c3a7e3c25c842cb9f20cbc8c18f8be0461a4a0dcc861ad386a0
+          image: docker.io/library/python:3.15.2-alpine@sha256:0f9552bb28711333da16915ec146f5e6bb44a7fdac9ced15dc17c2e0206346dd
           imagePullPolicy: IfNotPresent
           command:
             - python3