update requirements, stop using dependabot

[davidism]

Update dev and pre-commit requirements using pip-compile-multi instead of pip-compile. This updates all files at once rather than having to compile each file individually.

Dependabot opens one PR per dependency, which gets really noisy, especially since our updates almost never fail and its immediately obvious what the fix is even with everything combined. If they ever support updating everything at once, I might enable it again, but I'm also considering moving away from pip-compile. For now, I'll occasionally run pip-compile-multi and make a PR each month or so.

Use the setup-python action's built-in pip caching instead of writing it manually, although if we move away from requirements.txt we'll need to add our own caching back in for whatever tool is chosen.