fix(CVE-2024-39705): bump to nltk 3.9.1; correct model download issues

[MthwRobinson]

Summary

Bumps to nltk==3.9.1 and resolves CVE-2024-39705. An NLTK version bump was originally introduced in #3512 and rolled back in #3527 because nltk==3.8.2 was yanked from PyPI, and also because we observed significant slowdowns in processing time after bumping to nltk==3.8.2. The processing time regression does not appear in nltk==3.9.1.

Testing

After the bump, CI should pass. Additionally we verified locally that files processing takes around the amount of time we would expect for a long .docx file.

In [1]: from unstructured.partition.auto import partition

In [2]: filename = "test-doc.docx"

In [3]: %timeit partition(filename=filename)
3.92 s ± 73 ms per loop (mean ± std. dev. of 7 runs, 1 loop each)

[christinestraub]

LGTM!