actions: Use pip cache

[jku]

All actions (actions/*/action.yml) that use setup-python should use cache and cache-dependency-path keys.

The correct paths are likely repo/pyproject.toml and repo/install/requirements.txt

[jku]

Apparently this is not possible without really ugly workarounds:

• Support cache-dependency-paths outside the current directory actions/setup-python#361
• Support hashing files outside the workspace directory actions/toolkit#1035

[jku]

Currently all our actions have a copy of this:

    - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
      with:
        python-version: "3.11"

    - run: |
        echo "::group::Install tuf-on-ci"
        ROOT=$GITHUB_ACTION_PATH/../..
        pip install -c $ROOT/action-constraints.txt $ROOT/repo/
        echo "::endgroup::"
      shell: bash

we could replace them all with:

    - uses: ./actions/_internal/setup

The new internal action _internal/setup would then:

• copy $ROOT/action-constraints.txt into a location within the workspace
• setup python with caching using the copy of action-constraints.txt
• install tuf-on-ci (now using cache)

The advantages would be:

• caching is possible
• changes (like python version upgrade) happen in a single place

The only possible issue I see is the cache being somehow poisoned (accidentally or no). Without hashes in action-constraints.txt I'm not sure I'd like to enable the caching

[jku]

Without hashes in action-constraints.txt I'm not sure I'd like to enable the caching

I've had a look at this. The original issue remains:

• we could add --generate-hashes when calling pip-compile: This adds hashes to action-constraints.txt. These get automatically used by pip
• Unfortunately pip install -c action-constraints.txt repo then starts failing because pip requires everything to be hashed if anything is... and "repo" can't be hashed because it's just a local repository we want to install from

Possible solution 1:

• In the actions we could replace
  pip install -c $ROOT/action-constraints.txt $ROOT/repo/
  with
  pip install -r $ROOT/action-constraints.txt && pip install $ROOT/repo/
• that still leaves tox.ini unsolved -- same solution is not usable there

this really should not be this difficult