Modernise tooling (pyproject.toml, nox, uv)

[Tronic]

Implementing #3074

[Tronic]

Now uv run nox runs pretty much everything starting with formatting, and it passes all stages except the tests because many of them are still flaky. However, this platform at least allows me to run tests (that has been broken for a long time with tox & friends).

An open question is whether to replace bandit entirely with ruff. Currently ruff security checks (S) are disabled in config and we run bandit separately. These could all naturally be part of the lint action, along with type checking.

[ahopkins]

I have a local branch where I have already largely done a lot of this. I do not want to introduce it until next year though after December release.