Ref: https://github.com/encode/httpx/blob/master/CHANGELOG.md#0260-20th-december-2023

pytz dependency is removed. isodate is still needed for ISO durations
and missing features in Python's ISO datetime parser.

Also bumps the pytest-asyncio pin in tox.ini from 0.11.0 to the 0.24
series, since the old pin doesn't support Python 3.14.

The forbid_external setting was defined but unused since the move off
defusedxml in 4.0. When enabled it now refuses to transitively fetch
http/https resources via xsd:import, xsd:include, wsdl:import or lxml
entity resolution, raising ExternalReferenceForbidden. The user-supplied
entry-point WSDL/schema URL is still loaded.

The default is changed to False to preserve existing behaviour; enable
when loading WSDLs from untrusted sources to mitigate SSRF via
attacker-controlled import targets.

- Manage env and deps with uv; add committed uv.lock
- Move test deps into PEP 735 [dependency-groups] dev group
- Replace isort/flake8/black with ruff (lint + format)
- Remove tox.ini; CI matrix + uv run --python replaces it
- Add `make test-all` sweep using isolated per-version .venv-py* envs
- Update GitHub workflows: setup-uv with caching, uv sync/run for
  test+coverage, uv build for release (OIDC publishing unchanged)

The old CI only checked black/isort formatting, never flake8, so these
pre-existing issues were never enforced. Now that the format job runs
`ruff check`, fix them:

- loader: drop redundant lxml XMLSyntaxError import (zeep's is used)
- proxy/signature: use `is`/`is not` for type and None comparisons
- complex: `type(element) is list` (NOT isinstance -- Sequence subclasses
  list and would be double-wrapped)
- builtins: remove unused `math` import
- xsd/__init__: explicit re-export aliases for Nil/SkipValue
- tests: drop unused vars, fix `== True`, detab XSD fixtures, strip
  trailing whitespace

uv installs the project editable, so coverage records src/zeep/... paths
instead of the site-packages paths tox produced. The per-OS absolute
prefixes (/home/runner, /Users/runner, D:\a) then failed to unify on the
coverage job ("No source for code"). Set relative_files = true so paths
are stored relative to the repo root and combine cleanly across runners.

Derive __version__ (and the docs version) from installed package
metadata via importlib.metadata, so pyproject.toml is the single source
of truth. Removes the need to keep four files in sync and lets releases
use `uv version --bump`. Delete .bumpversion.cfg.