Update Oscar dependencies

* Django version range has been bumped to a minimum of 1.4.9 because
  that's the latest security release
* Pillow has been bumped to a new max of 2.5 because Pillow 2.3.1 fixes
  a security issue
* treebeard has been bumped from it's beta to the stable release.
* Babel has been given an upper limit because that's good practice. Purl
  is developed in-house and can be left without an upper limit, and one
  can assume that six won't break backwards compatibility.