Use osv-scanner to scan `uv.lock` files

The `scan-python` workflow should scan `uv.lock` with osv-scanner.

Blocked by https://github.com/google/osv-scanner/issues/1406

Start with the repository's `scan-python` workflow and inspect how its current dependency files are passed to osv-scanner. Check the linked osv-scanner issue #1406 before making changes, since this work is explicitly blocked. Done means the workflow scans `uv.lock` files successfully without breaking its existing scans.

Written by the indexing model from the issue text.