add a pip locking versions functionality for backend addon installation

[ionlizarazu]

• I signed and returned the Plone Contributor Agreement, and received and accepted an invitation to join a team in the Plone GitHub organization.
• I verified there aren't any other open pull requests for the same change.
• I followed the guidelines in Contributing to Plone.
• I successfully ran code quality checks on my changes locally.
• I successfully ran tests on my changes locally.
• If needed, I added new tests for my changes.
• If needed, I added documentation for my changes.
• I included a change log entry in my commits.

---

If your pull request closes an open issue, include the exact text below, immediately followed by the issue number. When your pull request gets merged, then that issue will close automatically.

Closes #

[davisagli]

This doesn't look like the right way to use a lock file to me:

• This Makefile target depends on $(VENV_FOLDER) which already installed packages without a lock file.
• Compiling the lock file at the same time that you install it defeats the purpose of using a lockfile (to avoid unexpected updates)

[ionlizarazu]

Reading the uv docs "When using an output file, uv will consider the versions pinned in an existing output file. If a dependency is pinned it will not be upgraded on a subsequent compile run."

So, this should lock the versions installed during the first run, right?

[davisagli]

Ok, I retract my second point then. But it still doesn't make sense to compile the lockfile after packages were already installed into the virtualenv. And also @ericof is working on a larger change to use uv sync and uv.lock in #287

[erral]

Reading the uv docs "When using an output file, uv will consider the versions pinned in an existing output file. If a dependency is pinned it will not be upgraded on a subsequent compile run."

So, this should lock the versions installed during the first run, right?

we are not using UV lock files, but pip lock files, anyway as far as we checked the docs, the behavior of the command is the same, the file is checked before writing to it.

Anyway we need that support also inside the Dockerfile, to build the image with the locked versions.

[davisagli]

Please talk to @ericof first and agree whether or not we can move toward using uv sync, so we don't have work happening in two different directions.