Figure out a better dependency pinning strategy

_Originally posted by @waxlamp in [#2325](https://github.com/dandi/dandi-archive/issues/2325#issuecomment-2813468086)_:

> Heroku suggests specifying the Python minor version but not the patch level, which means Python versions will upgrade more frequently, with attendant invalidation of the pip cache and therefore more upgrades of dependencies, possibly into incompatible versions, etc. So if we follow Heroku's full recommendation, we'll need a more robust version pinning strategy.
>
> My initial feeling is to restrict all dependencies to their current versions via the [compatible release](https://packaging.python.org/en/latest/specifications/version-specifiers/#compatible-release) operator, which holds the major version constant and allows for updated minor versions.
>
> Alongside that, we should have better hygiene around dependabot's suggestions for security updates, etc.

As part of this issue:
- [ ] Remove the patch level from `.python-version`
- [ ] Overhaul dependency version constraints

Start with `.python-version`, then locate the project’s dependency declarations and current Dependabot setup to understand the existing constraints. Done means the patch-level Python pin is removed, dependency constraints follow an agreed strategy, and security-update handling is documented or configured consistently.

Written by the indexing model from the issue text.