* feat: bump pre-commit hooks and add ci section

* fix pre-commit check fail

* fix: omit cpp_linter/__init__.py

- Use `uv` to manage dependencies
- Remove requirements*.txt in favor of uv.lock
- Updated dependabot config to use uv.lock file
- Use `nox` as the project task runner
- Updated CI to use `uv` and `nox`
- Add CONTRIBUTING doc about on-boarding info
- Update RTD config
- Update gitpod config
- Adjust coverage.py config
- Include clang v20 in CI tests (and drop clang v7)

updates:
- [github.com/astral-sh/ruff-pre-commit: v0.11.10 → v0.12.2](astral-sh/ruff-pre-commit@v0.11.10...v0.12.2)
- [github.com/pre-commit/mirrors-mypy: v1.15.0 → v1.16.1](pre-commit/mirrors-mypy@v1.15.0...v1.16.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Bumps the actions group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 5 to 6
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v5...v6)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

Updates `actions/download-artifact` from 4 to 5
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- adjust CI matrix about tested clang versions and switch back to ubuntu-latest
- pin actions to their SHA instead of using their tags
- change dependabot updates to monthly check
- rewrite release CI (per cpp-linter/.github#41)
- explicitly specify permissions needed
- add zizmor static analysis

Some permissions were in adequate after merging #151.
This was hard to predict because the permission requirements
changed between PR and push events to main.

explicitly provide GITHUB_TOKEN

)

Bumps the actions group with 1 update: [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/setup-python` from 5.6.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...e797f83)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This new `_version.py` file is gitignored and generated at build time. It will be distributed to pypi though.

The generated code is used as

1. a part of the custom `User-Agent` request header (`cpp-linter/<version>`).
   This should help identify REST API requests as unique requests from this software. The `requests` lib default user-agent value is set similarly but specific to the requests library (`python-requests/X.Y.Z`).
2. the output of the new CLI subcommand `cpp-linter version`.
   This is meant to differentiate between the global `--version` arg used to specify a clang version.

### Other changes
- ran `uv sync --all-groups -U` to upgrade locked dependencies
- update pre-commit hooks and ran them
- updated the test about listing changed files to ensure the user-agent is set accordingly.
- updated test about CLI parsing to ensure the new subcommand is respected (when used)
- updated CLI docs about new subcommand

---
All of this is already implemented in the cpp-linter-rs port.
So, this patch aligns with the future v2, disregarding the difference in `--help` output.

now that it uses uv in reusable workflow

see also cpp-linter/.github#52

ref cpp-linter/cpp-linter-action#331

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: shenxianpeng <[email protected]>
Co-authored-by: Brendan <[email protected]>