Use `uv` in CI workflows and add `uv.lock`

[ml-evs]

Just toying around to see what this would involved. Related to #2311.

Main outstanding question is how we can modify our dependabot approach to keep direct deps tested and up to date whilst making better use of explicitly pinned subdeps during our own builds.

Options:

1. keep requirements.txt files for dependabot and remember to update uv.lock when necessary
2. tell dependabot to only look at pyproject.toml deps and broaden them where necessary, then forcing uv.lock updates too
3. tell dependabot to explicitly watch uv.lock (seemingly not well supported)
4. run our own scheduled workflow that proposes changes to uv.lock (could be used in conjunction with 2.)