Update lock-dependencies to scrub CDN references (#392)

This PR updates the `lock-dependencies` target so that it also scrubs
mirror information from the `url = ` references: these refer to the PyPI
CDN.

This change is needed because some mirrors/proxies also rewrite the CDN
URLs: without this change `uv.lock` refers to environment-specific URLs
instead of PyPi.

In addition to the `Makefile` changes, the locks have been refreshed.

Author: asnare

Makefile

@@ -48,7 +48,10 @@ lock-dependencies:
 	$(UV_RUN) --group yq tomlq -r '.["build-system"].requires[]' pyproject.toml | \
 	    uv pip compile --upgrade --generate-hashes --universal --no-header --quiet - > build-constraints-new.txt
 	mv build-constraints-new.txt .build-constraints.txt
-	@perl -pi -e 's|registry = "https://[^"]*"|registry = "https://pypi.org/simple"|g' uv.lock
+	@perl -pi \
+		-e 's|registry = "https://[^"]*"|registry = "https://pypi.org/simple"|g;' \
+		-e 's|url = "https://[^"]*/packages/([^"]*)"|url = "https://files.pythonhosted.org/packages/$$1"|g;' \
+		uv.lock
 	@printf 'Stripped registry references from uv.lock.\n'
 
 .DEFAULT: all