ci: install tox from a hash-pinned requirements file

[markuslf]

Resolves the PinnedDependenciesID Scorecard alert (#41): pip install tox was unpinned.

Why this is not just a requirements file

A single hash-pinned file cannot serve the whole 3.9-3.13 matrix. From Python 3.10 on, virtualenv requires filelock >= 3.24.2, and no filelock that new supports 3.9. Compiling on 3.9 pins filelock==3.19.1, and installing that with --require-hashes under 3.12 fails:

The conflict is caused by:
    The user requested filelock==3.19.1
    tox 4.30.3 depends on filelock>=3.18
    virtualenv 20.39.1 depends on filelock<4 and >=3.24.2; python_version >= "3.10"

So tox is installed under a fixed Python 3.13 and pointed at the matrix interpreter with --discover. The test envs still run under the matrix Python; only the tox process itself moves. That is what tox is designed for.

--discover takes the absolute path from actions/setup-pythons python-path output rather than relying on PATH order, because the action documents only that "the last specified version will be used as a default one" - it does not promise that an earlier version stays reachable as pythonX.Y.

Verification

In a Fedora 44 container with Python 3.13.14 and 3.9.25, tox 4.56.4 installed under 3.13:

• with python3.9 moved off PATH and no --discover: py39-ansible215: failed with could not find python interpreter matching any of the specs py39
• same state, with --discover /opt/py39: env builds and sys.version_info reports 3.9, congratulations :)

pip install --require-hashes -r .github/tox/requirements.txt resolves cleanly under 3.13. actionlint is clean.

Dependabot already maintains the hash-pinned .github/pre-commit/requirements.txt (#234), so a watchpoint for .github/tox keeps these hashes current too.

Also quotes the tox factor subshell, silencing a pre-existing shellcheck SC2046 warning.