Python requirements - use dependabot only for security, and pip-compile for everything else

Dependabot is not coping with the pydantic-core package. A better solution might be to only have it report security issues, and run pip-compile regularly ourselves.

I've switched off dependabot package updates now - so that just security checks are done. I'll create a new issue for the pip-compile action that we can action once that is created for the RSE team.