ci: Pin transitive dependencies for tests on Python>=3.8

[alexander-alderman-webb]

Description

Add transitive dependencies to all test groups that are generated by populate_tox.py.
Dependency versions are resolved via a dry run of pip through uv on the relevant Python version.
Pins one set of dependencies per Python version and per library version.

Update DEPENDENCIES_CACHE to also be keyed on the Python version, since dependency versions of a package depend on the Python version. The cache is now indexed on the package name, package version, and Python version.

Issues

Reminders

• Please add tests to validate your changes, and lint your code using tox -e linters.
• Add GH Issue ID & Linear ID (if applicable)
• PR title should use conventional commit style (feat:, fix:, ref:, meta:)
• For external contributors: CONTRIBUTING.md, Sentry SDK development docs, Discord community

[github-actions]

Codecov Results 📊

✅ 88336 passed | ⏭️ 6007 skipped | Total: 94343 | Pass Rate: 93.63% | Execution Time: 302m 5s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +161
Passed Tests	📈 +163
Failed Tests	—
Skipped Tests	📉 -2

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2311 uncovered lines.
❌ Project coverage is 89.97%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    89.98%    89.97%    -0.01%
==========================================
  Files          191       191         —
  Lines        23064     23040       -24
  Branches      7922      7908       -14
==========================================
+ Hits         20752     20729       -23
- Misses        2312      2311        -1
- Partials      1310      1308        -2

---

Generated by Codecov Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d26dd8a. Configure here.}

[sl0thentr0py]

maybe time to add tox.ini to .gitattributes as well

[sentrivana]

LGTM overall, but -latest should ideally be a verbatim copy of -v{max}, including the transitive pins. Otherwise they're two different test targets, and -latest succeeding locally when developing doesn't guarantee that CI will pass on the corresponding latest version. (That's never a guarantee, but I wouldn't introduce additional drift.)