Pin CI pip installs by hash and update KaTeX/DOMPurify

The pip installs in check_amalgamation.yml, ubuntu.yml (Meson) and
semgrep.yml now use --require-hashes with requirements files compiled by
pip-compile --generate-hashes (Python 3.14, as on ubuntu-26.04). The
astyle and generate_natvis requirements move to requirements.in, and
Meson and Semgrep get theirs in .github/requirements, which Dependabot
now watches. check_amalgamation.yml installs the natvis requirements
from the PR tree, as it already does for astyle.

The Mermaid checker overrides KaTeX to 0.18.11 (GHSA-238p-pmpm-9mq7;
Mermaid 11 still requires ^0.16.47) and updates DOMPurify to 3.4.17
(GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f).

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/check_amalgamation.yml

@@ -67,10 +67,10 @@ jobs:
       - name: Install astyle
         run: |
           python3 -mvenv venv
-          venv/bin/pip3 install -r $MAIN_DIR/tools/astyle/requirements.txt
+          venv/bin/pip3 install --require-hashes -r $MAIN_DIR/tools/astyle/requirements.txt
 
       - name: Install generate_natvis dependencies
-        run: pip3 install -r $NATVIS_TOOL_DIR/requirements.txt
+        run: pip3 install --require-hashes -r $MAIN_DIR/tools/generate_natvis/requirements.txt
 
       - name: Regenerate the tools/macro_builder tables in macro_scope.hpp
         run: |

.github/workflows/semgrep.yml

@@ -53,7 +53,7 @@ jobs:
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
       - name: Install Semgrep
-        run: python3 -m pip install --user semgrep==1.168.0
+        run: python3 -m pip install --user --require-hashes -r .github/requirements/semgrep.txt
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.

.github/workflows/ubuntu.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Check that Meson and pkg-config offer the CMake options
         run: make check_build_options
       - name: Install Meson
-        run: pip install meson
+        run: pip install --require-hashes -r .github/requirements/meson.txt
       - name: Install with Meson
         run: |
           meson setup build-meson --prefix=${{ github.workspace }}/install