Please merge the setup-uv bump and cut a release (v2.8.0 pins setup-uv v7.0.0)

The latest release, v2.8.0 (2025-11-05), pins `astral-sh/setup-uv@eb1897b8` (v7.0.0). `main` has since moved to v7.3.0, and open dependabot PRs #214 and #218 would take it to v8.2.0 / v8.3.0, but none of that is in a release yet.

This matters for consumers who pin transitive actions by SHA. The Apache Software Foundation maintains an allowlist of approved action SHAs, and every action referenced by an allowlisted action has to be on it too. `helm/chart-testing-action@6ec842c0` (v2.8.0) is approved, but the setup-uv v7.0.0 it pulls in is not, so the reference fails to resolve for ASF projects.

Cutting a release from current `main` would not resolve it on its own, since v7.3.0 is not on the allowlist either. What would is merging #218 first: it pins `astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3` (v8.3.0), which is already an approved SHA. #214 (v8.2.0) would work equally well.

So the ask is: merge one of those bumps and tag a release. That also gets everyone else off a setup-uv release that is now several majors behind.

Happy to open the PR if that helps.

Review Dependabot PRs #214 and #218 first, then compare their setup-uv pins with the v2.8.0 release and current main. Done means merging one approved bump and tagging a new release so consumers no longer resolve the unapproved v7.0.0 SHA.

Written by the indexing model from the issue text.