Constrain development tools by Python version

[mpounsett]

Summary

• scope lint and security dependency groups to Python 3.11+
• use pytest 8 only for Python 3.9 and pytest 9 for Python 3.10+
• regenerate uv.lock without obsolete Python 3.9/3.10 tooling forks
• document when the temporary compatibility constraints can be removed in
  HACKING.txt

This allows Dependabot's lockfile-only uv updater to resolve current tool
versions without narrowing nagiosplugin's Python 3.9 runtime support. The
Python-specific pytest split also keeps supported modern interpreters on a
version containing the current security fix.

Related issue

Relates to failed Dependabot updates #1470503404 and #1470560516.

Testing

• uv lock --check
• grouped upgrade simulation for pytest, NumPy, Pylint, Bandit, and pip-audit
• tox test matrix on Python 3.9 through 3.13 (140 passed, 1 skipped each)
• pytest 8.4.2 selected on Python 3.9; pytest 9.1.1 selected on Python 3.10+
• Ruff critical checks
• Bandit baseline check
• pip-audit on the Python 3.13 security environment (no vulnerabilities)
• Sphinx documentation build with warnings treated as errors

Compatibility and security

Package runtime behavior and dependencies are unchanged. The Python 3.9 test
environment remains on the last compatible pytest major release; maintained
Python 3.10+ environments receive the patched current major release.

Checklist

• I have read and followed the contribution guide
• Tests were added or updated where appropriate
• Documentation and history were updated where appropriate
• The PR title clearly describes the change