thumbor: fix build

thumbor 6.3.2 requires Pillow >=3.0.0 && <4.0.0 whereas presently nixpkgs'
Pillow is at 4.x.x. An upstream commit in a yet unreleased version of thumbor
relaxes the bounds to >=3.0.0 && <5.0.0, and is included here as a patch.