Update CI config

[hugovk]

• Since https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.11.0, attestations are on by default
• Fix https://github.com/woodruffw/zizmor findings
• Lint with faster tox-dev/action-pre-commit-uv instead of pre-commit/action (see CI: Lint and test via uv blurb#32 for similar timings, let me know if you want some for this repo)
• Test with faster tox-uv instead of tox
• Explicitly install types-requests stub for mypy: (done in Fix mypy pre-commit settings #148)
• Install and run safety via uv