www/immich: Security update to 3.4.0

An attacker-chosen OAuth state cookie allowed forced account linking and
takeover of any account. Further fixes cover a partner reading locked
folder metadata, read-scoped API keys resetting cluster group people
data, an unbounded motion photo offset exhausting memory and disk, and a
share link revealing whether the owner has a given file.

Adds JPEG XL support, two new match types for the EXIF metadata filter
and a trigger that runs a workflow once OCR processing has finished.

Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0

Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH