Update to latest repo-template and uv

Compare the repository's dependabot.yml, requirements.* files, pyproject.toml, justfile, Dockerfiles, .dockerignore, pre-commit configuration, DEVELOPERS.md, and GHA workflows with repo-template. Start by reviewing the referenced template and current project files, then run the listed just commands as changes are made. Done means the checklist is complete, uv.lock is generated, dependency updates and Docker builds work, and the checks pass.

Refer to https://github.com/opensafely-core/repo-template

Note: you probably want to commit with --no-verify until the justfile is updated and committed; otherwise pre-commit hooks will use old justfile commands and fail confusingly.

• Update dependabot.yml for github actions to include 7 day cooldown
• Move dependencies from requirements.prod.in into pyproject.toml [project]
• Copy tool.uv section from repo-template and move dev dependencies from requirements.dev.in into pyproject.toml [dependency groups] (remove pip and pip-tools if they're in the dependencies)
• Delete requirements.* files
• Add a .python-version file (if there isn't one already)
• Update justfile with repo-template recipes; note that devenv is not required for most recipes anymore (but recipes that require a .env file may need _dotenv setup). In addition to adding the new recipes/versions of recipes for uv, update any extra ones that do e.g. python ... to uv run python ...
• Run just clean to remove any old venv
• Run just devenv, just check/test/run to make sure things work and generate a uv.lock
• Run just update-dependencies and check that works too, and the exclude-newer timestamp in pyproject.toml and uv.lock has been correctly updated to 7 days ago
• Update pre-commit config if necessary (compare with repo-template)
• Update Dockerfiles to use uv (following repo-template Dockerfile)
• Ensure that .python-version and pyproject.toml are not ignored in the .dockerignore file
• Run just docker/build to check it's working
• Update DEVELOPERS.md to include sections from repo-template on using uv and updating dependencies
• Update GHA workflows; any jobs that use setup-action will need to add:
  install-uv: true
  cache: uv
  But you can remove the python version unless you have anything in a workflow job that runs python without using uv.