use pip-compile and dependabot grouped updates

[davidism]

• Use Dependabot's grouped updates feature, and enable Python updates. This will result in only two PRs a month, one for GitHub Actions and one for Python requirements.
• pip-compile is used instead of pip-compile-multi, as Dependabot messes up the slightly different format that multi produces.
• Update tests Python matrix to include 3.12 final.
• Update the Read the Docs env to use latest OS and Python versions.