Resolves #6947

This switches to uv in all CI jobs and adds a uv lockfile for deterministic build dependencies. Previously, the sdist tarball and bdist wheels were built in an isolated venv via build that simply had a min-version requirement. This is now controlled by the lockfile. Other build dependencies like shtab and sphinx are of course also locked.

This PR therefore also adds a dependabot update entry for uv, but only for the lockfile, since we bump our runtime-, build- and dev-dependencies ourselves. Sphinx has been added to the ignore list due to a bug in the latest major version which is still not resolved. Updating the lockfile locally therefore needs to be done carefully, and any Sphinx update should not be committed.

The updated CI test job unfortunately can't make use of the uv-managed venv when executing uv run, as we install custom wheels in freethreaded or pre-release Python environments. I've tried a lot of things with uv's sources config and additional requirements.txt files, but couldn't make it work. One of the issues is the lack of an environment marker for freethreaded Python builds, so the package manager can't distinguish between normal builds and no-GIL builds when choosing a wheel to download. The BASH script is therefore strictly necessary. Even if the astral-sh/setup-uv action does have the ability to cache dependencies, some of the custom wheels we build require additional setup, so it's not possible to just build them once here from their sdists and then cache the resulting wheels.

Before merging, I will have a second look at all the changes and I will also have to do a test release on my test repo to be sure that everything is indeed working correctly. I will do that sometime later.

Regarding the Windows builds and Linux AppImages, since we'll now finally have a lockfile for all runtime dependencies here, these build-repos can make use of it and filter for their respective platforms, always matching the commit where it's built from.