Drop support for legacy Python versions

[tomodwyer]

Part of #280

This PR removes support in OpenSAFELY CLI for Python v3.8 and v3.9. As we are now updating to use 3.10, we take the opportunity to bump our dependencies, meaning we can also remove black and replace it with ruff - as we have in other repos.

This PR does not include just update-vendored-dependencies as that is a RAP task.

Changes

• Bump minimum Python version to 3.10
• Update dependencies for Python 3.10+
• Replace black with Ruff
  Now that we have updated to a modern version of Ruff
• Run just fix to update syntax for Ruff

[StevenMaude]

The changes look fine; thanks for this.

Before we merge this, is it worth considering a final <3.10 supporting release with a check of the Python version at startup, and a warning if the Python version is <3.10?

The warning might state something like:

The installed Python version being used to run the OpenSAFELY CLI is older than Python 3.10 and now end-of-life.

This installed version of OpenSAFELY CLI will continue to run, but you will no longer receive new versions of the OpenSAFELY CLI.

Please upgrade your Python installation to ensure you can upgrade to new versions of the OpenSAFELY CLI.

It's fine if the answer is "no", but I'm not sure if this idea has been discussed anywhere before.

[StevenMaude]

thought: I would really like for us to go to further on this, but also concede that this is a reasonable and low risk improvement for now.

That's since:

• Python 3.10 is nearly five years old, which still restricts us from using some newer features.
• Python 3.10 is end-of-life as of end October 2026 (just three months). We'll be shortly in the situation again where dependencies can't be updated: they'll drop support for end-of-life Python.

But #280 was only scoped to the end-of-life versions incrementally.

So for now, I'll happily take a more regular maintenance cycle in line with Python end-of-life. Maybe other ideas like using uv (#277) make this simpler for end users to manage upgrades in future?

Doing this as a hopefully minimally disruptive upgrade with few users affected gets us some way towards modernising our users' installations, and figuring out how best to conduct these upgrade cycles.

[tomodwyer]

@StevenMaude yes I think moving the uv and getting off 3.10 before the end of its life cycle should be the next steps.