ci: pin pip dependencies by hash (#6046)

Add sha256 hashes for every release file to the requirements of the
astyle and natvis tools, and install Meson in the ubuntu workflow from a
new hashed requirements file with --require-hashes instead of an
unpinned "pip install meson". pip verifies all installs from these files
once they contain hashes, including the ones of the Makefile and
cmake/ci.cmake. Addresses the Scorecard Pinned-Dependencies alerts for
ubuntu.yml; the check_amalgamation.yml flags follow once develop has the
hashes.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/ubuntu.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Check that Meson and pkg-config offer the CMake options
         run: make check_build_options
       - name: Install Meson
-        run: pip install meson
+        run: pip install --require-hashes -r cmake/requirements/requirements-meson.txt
       - name: Install with Meson
         run: |
           meson setup build-meson --prefix=${{ github.workspace }}/install