Update to latest repo-template and uv

[rebkwok]

(We already use uv, but not quite in the same way yet - checklist below assumes upgrading from a pip-tools project, will need some modification)

Refer to https://github.com/opensafely-core/repo-template

Note: you probably want to commit with --no-verify until the justfile is updated and committed; otherwise pre-commit hooks will use old justfile commands and fail confusingly.

• Update dependabot.yml for github actions to include 7 day cooldown
• Move dependencies from requirements.prod.in into pyproject.toml [project]
• Copy tool.uv section from repo-template and move dev dependencies from requirements.dev.in into pyproject.toml [dependency groups] (remove pip and pip-tools if they're in the dependencies)
• Delete requirements.* files
• Add a .python-version file (if there isn't one already)
• Update justfile with repo-template recipes; note that devenv is not required for most recipes anymore (but recipes that require a .env file may need _dotenv setup). In addition to adding the new recipes/versions of recipes for uv, update any extra ones that do e.g. python ... to uv run python ...
• Run just clean to remove any old venv
• Run just devenv, just check/test/run to make sure things work and generate a uv.lock
• Run just update-dependencies and check that works too, and the exclude-newer timestamp in pyproject.toml and uv.lock has been correctly updated to 7 days ago
• Update pre-commit config if necessary (compare with repo-template)
• Update Dockerfiles to use uv (following repo-template Dockerfile)
• Ensure that .python-version and pyproject.toml are not ignored in the .dockerignore file
• Run just docker/build to check it's working
• Update DEVELOPERS.md to include sections from repo-template on using uv and updating dependencies
• Update GHA workflows; any jobs that use setup-action will need to add:
  install-uv: true
  cache: uv
  But you can remove the python version unless you have anything in a workflow job that runs python without using uv.