dependabot's security updates remove path prefixes from

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

pip

### Package manager version

_No response_

### Language version

Python 3.11

### Manifest location and content before the Dependabot update

[pypi/warehouse@`ccabe51` (#15760)](https://github.com/pypi/warehouse/pull/15760/commits/ccabe517d3e507c2d81276b94a3e68890ba1aafe)

### dependabot.yml content

https://github.com/pypi/warehouse/blob/ba4e38c298a9d807044db563bd9385caa6017f56/.github/dependabot.yml

### Updated dependency

idna from 3.6 to 3.7

### What you expected to see, versus what you actually saw

When regular dependabot updates come in, they appear to run `pip-compile` from the root of the repo.

When dependabot is running a security update, it appears that `pip-compile` is being run in the `requirements/` subdirectory, removing the path prefixes from the resulting txt file, adding to merge conflicts and line churn.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

dependabot's security update: [pypi/warehouse@`ccabe51` (#15760)](https://github.com/pypi/warehouse/pull/15760/commits/ccabe517d3e507c2d81276b94a3e68890ba1aafe)
action taken to restore paths: [pypi/warehouse@`d99e287` (#15760)](https://github.com/pypi/warehouse/pull/15760/commits/d99e287ee16592381ed80d9df2aedb0ac6f534c4)

### Smallest manifest that reproduces the issue

_No response_

Start with the linked warehouse commits and its .github/dependabot.yml, comparing the regular and security-update dependency runs. Trace where the pip ecosystem invokes pip-compile and how its working directory is selected; done means security updates preserve the requirements/ path prefixes without introducing the reported diff churn.

Written by the indexing model from the issue text.