Add Forge Python dependency constraints

[im-sham]

Summary

• add a pinned constraints.txt for the Forge CI dependency set
• install Forge dev dependencies with -c constraints.txt in test and dependency-security jobs
• audit the pinned constraints file with pip-audit

Verification

• .venv/bin/python -m pytest tests/test_ci_workflow.py -q (5 passed)
• .venv/bin/python -m pip install -c constraints.txt -e ".[dev]"
• .venv/bin/python -m pip check
• .venv/bin/python -m ruff check forge_cli/ tests/
• .venv/bin/python -m pytest tests/ -q (71 passed, 1 skipped)
• .venv/bin/python -m pip_audit --progress-spinner off -r constraints.txt (No known vulnerabilities found)
• pip resolver dry-run under Python 3.11, 3.12, and 3.13