Pin CI pip installs by hash and update KaTeX/DOMPurify

The pip installs in check_amalgamation.yml, ubuntu.yml (Meson) and
semgrep.yml now use --require-hashes with requirements files compiled by
pip-compile --generate-hashes (Python 3.14, as on ubuntu-26.04). The
astyle and generate_natvis requirements move to requirements.in, and
Meson and Semgrep get theirs in .github/requirements, which Dependabot
now watches. check_amalgamation.yml installs the natvis requirements
from the PR tree, as it already does for astyle.

The Mermaid checker overrides KaTeX to 0.18.11 (GHSA-238p-pmpm-9mq7;
Mermaid 11 still requires ^0.16.47) and updates DOMPurify to 3.4.17
(GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f).

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -29,6 +29,13 @@ updates:
       - dependency-name: mermaid
         update-types: ["version-update:semver-major"]
 
+  - package-ecosystem: pip
+    directory: /.github/requirements
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:
@@ -36,7 +43,7 @@ updates:
     cooldown:
       default-days: 7
     ignore:
-      # astyle is deliberately pinned (see tools/astyle/requirements.txt): newer versions
+      # astyle is deliberately pinned (see tools/astyle/requirements.in): newer versions
       # reformat the code, and the pinned version defines the formatting CI enforces
       - dependency-name: astyle