Do not use pip-install; add dependency cooldowns

[JelleZijlstra]

Zizmor recommends against pip-install (https://docs.zizmor.sh/audits/#misfeature).

Also add dependency cooldowns to prevent supply-chain compromises.

[github-actions]

diff-shades results comparing this PR (8a0b468) to main (7613840):

--preview style: no changes

--stable style: no changes

---

What is this? | Workflow run | diff-shades documentation

[cobaltt7]

Zizmor recommends against pip-install because it installs dependencies to the global scope and makes them vulnerable to dependency conflicts. This change does the same thing, just without being flagged by Zizmor. The correct fix to this would be to create a venv inside the workflow and install dependencies there. IMO that's overkill and unnecessary because there's only one pip-install per job and not much opportunity for conflicts