1.23.1

### This is a security-focused patch release. Please read the upgrade notes before you upgrade.

## ⚠️ Upgrade notes

- **PostgreSQL 14 or higher is now required.** Label Studio now runs on Django 5.2, which doesn't support PostgreSQL 13 or older.
- **New secure defaults:**
  - `SSRF_PROTECTION_ENABLED=true`: outbound requests to private or local network addresses are blocked. This affects URL imports, webhooks, S3-compatible endpoints, and Redis storage.
  - `ML_BLOCK_LOCAL_IP=true`: ML backends on `localhost` or a private network are blocked.
  - `DEBUG_MODAL_EXCEPTIONS=false`: error details are no longer shown in the UI.

  If your ML backend, MinIO, Redis, or webhook receiver runs on a local or private network, set `SSRF_PROTECTION_ENABLED=false` and/or `ML_BLOCK_LOCAL_IP=false`. Alternatively, keep the protection on and change the blocked ranges with `USE_DEFAULT_BANNED_SUBNETS` and `USER_ADDITIONAL_BANNED_SUBNETS`.

## Security

- Stronger SSRF protection for ML backends, webhooks, cloud storage, and URL imports.
- Tighter permission checks when you create storages, webhooks, and ML backends, and when you delete users.
- Fixed access checks for local file storage and Data Manager filters.
- Improved HTML sanitization in the labeling interface.