chore: update actions and deps

[qartik]

using https://github.com/qartik/actupdate

Closes:

• https://github.com/Quantinuum/pytemplate/security/dependabot/7
• https://github.com/Quantinuum/pytemplate/security/dependabot/8

Documentation Improvements:

• Clarified in README.md that the uv dependency cooldown is now optional and provided instructions for enabling it as an extra safeguard.
• Commented out the exclude-newer setting in pyproject.toml, making it optional and explaining its purpose.

[Copilot]

Pull request overview

This PR refreshes selected dependency locks and tooling versions, primarily to address dependency/security updates while keeping the project’s uv-based workflow current.

Changes:

• Updates locked Python packages including urllib3, certifi, idna, packaging, prek, and ty.
• Adds a uv exclude-newer-package exception for urllib3.
• Updates pre-commit hook revisions and the setup-uv GitHub Action version.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
uv.lock	Updates locked package versions and records the urllib3 cooldown exception.
pyproject.toml	Adds the uv per-package exclude-newer override for urllib3.
.pre-commit-config.yaml	Updates typos, Ruff, and refurb hook revisions.
.github/workflows/python-app.yml	Updates the astral-sh/setup-uv action version used in CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.