deps: pin lint dependencies and group updates

[oliver-sanders]

Prevents lint failures from getting onto main branches as the result of new releases.

Dependabot will prepare PRs for these updates, the tests can fail there rather than on master.

The "real" way to achieve this is to use environment management tools (aka pipenv, poetry, uv, whatevs) which work similar to yarn/npm/whatevs, creating virtualenvs for dependency groups and providing wrappers to run things in them. But adopting something like that is a whole other thang.

Downstream cylc-repos which install cylc-flow[all] will subsequently pick up changes on their main branches. Note we cannot pin dependencies in more than one repo in this way as they'll conflict (that's where virtualenvs become unavoidable).

Check List

• I have read CONTRIBUTING.md and added my name as a Code Contributor.
• Contains logically grouped changes (else tidy your branch by rebase).
• Does not contain off-topic changes - off-topic change - unused dep removed
• Applied any dependency changes to both setup.cfg (and conda-environment.yml if present).
• Tests are included (or explain why tests are not needed).
• Changelog entry included if this is a change that can affect users
• Cylc-Doc pull request opened if required at cylc/cylc-doc/pull/XXXX.
• If this is a bug fix, PR should be raised against the relevant ?.?.x branch.