ci: Pin transitive dependencies for tests on Python>=3.8

[alexander-alderman-webb]

Description

Add transitive dependencies to all test groups that are generated by populate_tox.py.
Dependency versions are resolved via a dry run of pip through uv on the relevant Python version.
Pins one set of dependencies per Python version and per library version.

Update DEPENDENCIES_CACHE to also be keyed on the Python version, since dependency versions of a package depend on the Python version. The cache is now indexed on the package name, package version, and Python version.

Issues

Reminders

• Please add tests to validate your changes, and lint your code using tox -e linters.
• Add GH Issue ID & Linear ID (if applicable)
• PR title should use conventional commit style (feat:, fix:, ref:, meta:)
• For external contributors: CONTRIBUTING.md, Sentry SDK development docs, Discord community

[github-actions]

Codecov Results 📊

✅ 88017 passed | ⏭️ 6007 skipped | Total: 94024 | Pass Rate: 93.61% | Execution Time: 294m 57s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📉 -23
Passed Tests	📉 -21
Failed Tests	—
Skipped Tests	📉 -2

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2313 uncovered lines.
❌ Project coverage is 89.96%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    89.99%    89.96%    -0.03%
==========================================
  Files          191       191         —
  Lines        23028     23028         —
  Branches      7904      7904         —
==========================================
+ Hits         20722     20715        -7
- Misses        2306      2313        +7
- Partials      1307      1307         —

---

Generated by Codecov Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d26dd8a. Configure here.}

[sl0thentr0py]

maybe time to add tox.ini to .gitattributes as well

[sentrivana]

LGTM overall, but -latest should ideally be a verbatim copy of -v{max}, including the transitive pins. Otherwise they're two different test targets, and -latest succeeding locally when developing doesn't guarantee that CI will pass on the corresponding latest version. (That's never a guarantee, but I wouldn't introduce additional drift.)