Manage versioning of Poetry tool dependency

[per1234]

The project's Python package dependencies are managed by the Poetry tool.

Previously, the version of Poetry was not managed in any way.

The GitHub Actions workflows used whichever version of Poetry happened to be installed on the runner machine. This meant that the GitHub Actions workflows could break at any time through the poetry installation on the runner machine being updated to an incompatible version.

The contributors used whichever version of Poetry happened to be installed on their machine. This meant that they might get different results from that produced by the environment of the GitHub Actions workflows.

The better solution is to take the same approach for managing the Poetry dependency as done for the project's other dependencies:

• Install a specific version of Poetry according to a single source of versioning data.
• Use the Dependabot service to get automated update pull requests.

The logical place to define the poetry package dependency version is in pyproject.toml, as is done for all direct Python package dependencies.

Dependabot recognizes two forms of dependency data in the pyproject.toml file:

• Poetry
• PEP 621

Since Poetry can't be used to manage itself (it is instead installed using pipx), the obvious approach would be to define the poetry dependency in a PEP 621 field in the file. However, this is not possible because if Dependabot finds Poetry data in pyproject.toml, it ignores the PEP 621 fields. So it is necessary to define the Poetry dependency in the Poetry fields of the file. A special dependencies group is created for this purpose. That group is configured as "optional" so that it won't be installed redundantly by poetry install commands.

Unfortunately pipx doesn't support using pyproject.toml as a dependency configuration file so it is necessary to generate the dependency argument in the pipx command by parsing the project.toml file. The yq tool is used for this purpose.