Switch to uv for locked versions

[woodruffw]

The situation we keep ending up in where the requirements files break in weird ways thanks to Dependabot is very tiresome. I think we could avoid a lot of headache there by using uv export --format=requirements.txt or similar.

[jku]

Might also make sense to discuss/document the point of install/requirements.txt a bit... I would really like to have a "reliable" install source for sigstore-python CLI (a set of packages that is known to work without having to maintain a requirements.txt at point of use) but I don't really know how I could use install/requirements.txt for that purpose

[jku]

See also #1771