Pin dependencies to harden against supply chain attacks

[janhoy]

As suggested by Gus...

Hardens the build against supply-chain attacks and adds tooling to keep dependencies up to date.

Dependency pinning

• Add Dockerfile with base image pinned by digest (python:3.13-alpine@sha256:…)
• Add requirements.in (direct deps) and generate requirements.txt as a hash-verified lockfile via pip-compile --generate-hashes
• Pin GitHub Actions refs to commit SHAs in both workflow files
• Upgrade Pelican 4.9.1 → 4.11.0.post0 (drops pkg_resources dependency, fixes runtime error with setuptools 82+)

Dependabot

• Add .github/dependabot.yml covering pip, docker, and github-actions ecosystems (monthly updates)
• Dependabot natively regenerates requirements.txt from requirements.in on pip bump PRs

Developer tooling

• Add ./build.sh --lock to regenerate requirements.txt inside Docker (no local pip-tools needed); combine with -b to also rebuild the image
• ./build.sh -b auto-detects stale lockfile and rebuilds image if requirements.txt is newer than the cached image

Dependency upgrades

• beautifulsoup4 4.12.3 → 4.14.3, jsonschema 4.22.0 → 4.26.0, invoke 2.2.1 → 3.0.3, livereload 2.6.3 → 2.7.1, markupsafe 2.1.5 → 3.0.3, checksumdir 1.2.0 → 1.3.0

[gus-asf]

One comment, but not suggesting a change

[janhoy]

I did another round of cleanups, added python lockfile to pin sha for all py deps, a --lock option to regenerate locfile, and upgraded a bunch of packages, dependabot support etc. See updated PR description for a summary.

Coincidentally infra just messaged all projects using Pelican that we must stop using @main and that is one of the fixes here.