Modernize project metadata, swap to ruff, harden CI

[twoerner]

This branch modernizes the project metadata, swaps the formatter
from black to ruff, and hardens the CI workflow. It is split
into 20 small commits along clean logical lines so the reviewer can
walk the diff one concept at a time.

Project metadata

• Fix the silent required-python -> requires-python typo in
  pyproject.toml; PEP 621 ignored the misspelled key, so the
  package floor was effectively unenforced before this change.
• Drop Python 3.8 (end-of-life since October 2024) from the
  supported set; add Python 3.13 (October 2024) and 3.14 (October
  2025). The CI matrix moves with the same change so every declared
  interpreter is actually exercised.
• Declare the license via PEP 639 (license = "GPL-2.0-only",
  license-files = ["LICENSE"]).
• Add a maintainers = [...] block alongside the existing
  authors = [...] historical credit.
• Add the Changelog URL to [project.urls].
• Move the package version source into src/bmaptool/__init__.py
  (__version__); CLI.VERSION re-exports it so existing imports
  keep working. make_a_release.sh is updated to bump the new
  location.

Tests and dev extras

• Remove tests/oldcodebase/ (~6500 lines of pre-Python-3
  BmapCopy modules) and the backward-compat half of
  tests/test_compat.py that consumed them. The forward-compat
  half (current BmapCopy exercised against every historical bmap
  fixture in tests/test-data/) is preserved.
• Drop six from [project.optional-dependencies].dev since the
  backward-compat test is gone.
• In tests/test_api_base.py, pin pbzip2 -p1 and pigz -p 1 so
  the fixture-generation step uses a single worker. The default
  worker-per-CPU behavior has been seen to OOM on shared CI
  runners; single-worker mode trades wall-clock time for memory
  while still exercising both producer paths and producing valid
  bzip2/gzip streams for the TransRead.py consumer paths to
  decompress.

Formatter swap

• Replace black with ruff in [project.optional-dependencies].dev
  and add a [tool.ruff] block (line-length = 88,
  target-version = "py39").
• Apply a one-time tree-wide ruff format reformat in its own
  commit, isolated so it can be added to .git-blame-ignore-revs
  and git blame skips past it.
• Add .git-blame-ignore-revs at the repo root listing that
  reformat commit. GitHub honors the file automatically;
  contributors opt in locally with
  git config blame.ignoreRevsFile .git-blame-ignore-revs.

The ruff swap is scoped to formatting only on this branch. Enabling
[tool.ruff.lint] against the existing tree surfaces a substantial
backlog (~285 findings across pyupgrade, bugbear, and bandit rules)
that deserves a separate, focused triage rather than a rider on the
formatter swap.

CI hardening

• Replace the psf/black@stable step with a ruff format --check .
  step pinned to a known ruff version, so the formatter check uses
  exactly the configuration in pyproject.toml.
• Bump actions/checkout in the lint job from v3 (end-of-life,
  prints deprecation warnings) to v4 in its own commit.
• Pin every third-party action (actions/checkout,
  actions/setup-python) by 40-character SHA with a trailing
  # vX.Y.Z comment so the resolved commit is part of this repo's
  controlled state instead of re-resolving on every workflow run.
• Declare permissions: contents: read at workflow scope and on
  each job, so the GITHUB_TOKEN is no longer the default
  read-and-write scope.
• Set strategy.fail-fast: false on the test matrix so a failure
  on one Python version does not cancel the rest; knowing whether
  a failure reproduces across all interpreters or only one is the
  first useful triage signal.
• Add a non-blocking pip-audit step in the lint job that reads
  pyproject.toml and queries the OSV vulnerability database.
  continue-on-error: true keeps a new transitive-dep CVE from
  turning the workflow red; the findings are visible in the run
  log and can be acted on at the maintainer's cadence.
• Add .github/dependabot.yml opening grouped weekly pull
  requests for github-actions and pip so SHA pins and
  dev-extras versions stay current without manual chasing.

Changelog

CHANGELOG.md carries a single Added / Changed / Removed entry
for the branch.

Verification

Locally (on the developer machine):

• The full unittest suite passes (python3 -m unittest) with the
  new pbzip2 -p1 and pigz -p 1 flags in place; both producer
  paths still feed their TransRead.py consumer counterparts.
• python3 -m build produces an sdist and a wheel whose METADATA
  reports Requires-Python: >=3.9, confirming the
  requires-python typo cannot regress without the smoke check
  catching it.
• ruff format --check . is clean tree-wide.
• actionlint and yamllint are clean on
  .github/workflows/ci.yml and .github/dependabot.yml.

The branch is split into small, self-contained commits; each
commit on its own leaves the tree in a working state.