Rework check-vulnerability to leverage lock file without installing the package

Given the recent changes with our way of checking the packages, I think we could update the check-vulnerability action to avoid installing packages. Previously we didn't leverage a requirement file with safety but given that's our way of working now... I think we could simply do something like

`uv export --frozen --format requirements-txt -o requirements-for-safety.txt --extra EXTRA_TARGET --no-hashes`

and the same is probably available in poetry.

This might require some thoughts to align with the `skip-install` input logic.

Start by locating the check-vulnerability action and its skip-install input, then review the current package-checking flow. Compare exporting a frozen requirements file with the uv command shown and the equivalent Poetry workflow, including EXTRA_TARGET and --no-hashes. Done means vulnerability checks use the lock-file-derived requirements without installing packages and the skip-install behavior remains coherent.

Written by the indexing model from the issue text.