Consider building `just` and `uv` from source in CI to pin from specific hash

To protect ourselves from supply-chain attacks. It was triggered by this https://github.com/ethereum/execution-specs/pull/2555/changes/BASE..45e7b9c66d4599d01fa20c463738272f7b5bef20#r3007428399.

Tbh, there's other things we should do first, like removing questionable dependencies such as some of these:
https://github.com/ethereum/execution-specs/blob/c1d8f4215d470d237080f26f3833926e011e0ebf/pyproject.toml#L238-L247