Support uv.lock

[scastlara]

uv is an amazing package manager that is gaining traction in the community.

While it uses a pyproject.toml to define dependencies, by not checking the lockfile we are missing out on analyzing transitive dependencies.

Docs: https://docs.astral.sh/uv/concepts/projects/#project-lockfile