Migrate Python dependency management from pip-tools to uv

Summary

Migrate all Python services in the trainer repo from pip-tools (pip-compile) to uv for dependency locking and vulnerability scanning workflows.

Motivation

The kubeflow/sdk repo already uses uv for this purpose. Migrating trainer would:

• Eliminate the custom hack/scripts/update-source-dep.py script in favor of uv-native uv lock --upgrade-package and override-dependencies
• Align tooling across Kubeflow Python repos
• Simplify the OSV-Scanner auto-fix workflow
• Remove the need to pin pip-tools and track pip compatibility

Scope

• Replace pip-compile / pip-tools with uv lock for lockfile generation
• Update osv-scanner.yaml to use uv lock --upgrade-package + override pattern (reference: kubeflow/sdk)
• Update validate-lockfile.yaml to use uv lock --check
• Add helper scripts under .github/scripts/ (adapted from kubeflow/sdk)
• Delete hack/scripts/update-source-dep.py
• Replace requirements-lock.txt files with uv.lock
• Update Dockerfiles if they reference requirements-lock.txt

Components

• cmd/initializers/dataset
• cmd/initializers/model
• api/python_api

Reference

• kubeflow/sdk OSV-Scanner workflow: .github/workflows/osv-scanner.yaml