feat: upgrade xqwatcher to Python 3.12

[hiteshkava]

Description

Upgrades the xqwatcher Ansible role to provision Python 3.12, following
the same pattern as the xqueue role's Python 3.12 upgrade
(#386).

Changes

File	Change	Why
playbooks/roles/xqwatcher/defaults/main.yml	xqwatcher_python_version: python3.8 → python3.12; added xqwatcher_use_python312: true flag	Controls the interpreter for the main watcher venv (deploy_watcher.yml)
playbooks/roles/xqwatcher/tasks/main.yml	Added deadsnakes PPA + python3.12-dev apt-install task	This role had no Python-interpreter install task at all before this change — it relied entirely on the base AMI's default system Python (python3.8 on Focal). Bumping the variable alone, without this, would have silently broken provisioning on a fresh AMI, since Jammy doesn't ship python3.12 by default

Testing

• Verified via Launchpad's API that deadsnakes publishes python3.12-dev for Jammy, confirming the new apt-install task will resolve
• Could not run the actual Ansible playbook against a real instance from this environment — recommend a test AMI build before merging (same test-plan gap noted on the related xqueue PR's own description pattern)

Related PRs

• Application code: feat: add Python 3.12 support and drop Python 3.8 xqueue-watcher#1
• GoCD AMI pipeline: https://github.com/edx/edx-internal/pull/14969
• Reference (same pattern, different service): feat: upgrade xqueue to Python 3.12 #386

Out of scope / follow-up needed

• Per-course grader sandboxes (MITx-7.QBWx, MITx-6.00x in edx-internal's XQWATCHER_COURSES) use a separate PYTHON_EXECUTABLE pin, not controlled by this role change. That pin has been updated to python3.12 in the companion edx-internal PR, which also bumped MITx-6.00x's numpy pin from 1.11.2 (confirmed to fail installing under Python 3.12) to 1.26.4 (verified to install cleanly). Neither course's actual grader code (private, MIT-owned repos) could be verified for correctness under these versions — only installability was confirmed.