Transitive dependencies in `uv.lock` not updated by dependabot

Background

While the direct dependencies are updated by dependabot, transitive (indirect) dependencies are not, which seems to be a known problem: https://github.com/dependabot/dependabot-core/issues/14073

This is going to become a more pressing problem as we move to using uv for most new Python projects (#507).

There are a few potential problems with not updating transitive deps:

1. Not getting fixes for security vulnerabilities (though I believe you can configure dependabot to open PRs for these)
2. Not getting fixes for bugs/performance issues
3. Binary wheels for old versions of packages being removed (even fairly recent versions of packages seem not to have binary wheels on PyPI)

The last one was an issue with FROG (https://github.com/ImperialCollegeLondon/FROG/pull/942). I was trying to build the package on a researcher's machine, but seemingly one of the dependencies required a Rust toolchain, so the build just failed 😞.

Potential solutions

1. We could write a CI workflow which calls uv lock --upgrade at regular intervals to supplement what dependabot is doing
2. We could move to Renovate, which supports updating transitive dependencies out of the box

The downside of moving to a separate tool is that it would involve another configuration step, which is annoying. Might be worth it though. You can [use it for private repos] too.

Thoughts, everyone? Tagging @cc-a as this is vaguely security related 😄

Start by reviewing how Dependabot currently handles Python projects and the existing uv.lock files, then compare the proposed CI workflow using uv lock --upgrade with Renovate's uvlock support. Done means there is an agreed, documented approach that regularly updates transitive dependencies and is validated for the template's Python projects.